CVE-2026-6804

Name: CVE-2026-6804 — Vulnerability Record
Brand: Quanteta Data Lab
SKU: CVE-2026-6804

MEDIUM

CVSS v3.1: 5.3 · EPSS: 0.0029 (21.1 percentile)

NetworkNo privilegesNo user interactionMissing AuthorizationVendor advisory ref

Source data as of: 2026-07-12 05:00:25 UTC

At a glance

Severity: MEDIUM
CVSS: 5.3 v3.1 · NVD
EPSS: 0.0029 (21.1 percentile) · FIRST.org
CISA KEV: No
Type: Missing Authorization · NVD CWE
Attack conditions (CVSS vector): NetworkNo privilegesNo user interaction · Source: NVD Vector
Published: 2026-07-11 · Modified: 2026-07-11
References: Jump to references (8)

CVSS / EPSS / KEV

CVSS v3.1 5.3 / 10 MEDIUM Source: NVD

EPSS 0.0029 21.1 percentile Source: FIRST.org

CISA KEV No Source: CISA

Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources

Description

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to publish draft WordPress posts, exposing unpublished content, or unpublish live content, causing service disruption, by supplying arbitrary scenario IDs.

Record details

CVE ID: CVE-2026-6804
CVSS (v3.1): 5.3 (MEDIUM)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability subscore: 3.9
Impact subscore: 1.4
EPSS: 0.0029 (21.1 percentile) — 2026-07-12
CISA KEV: No
Weakness (CWE): CWE-862
Affected configurations (CPE): 0
Published: 2026-07-11
Modified: 2026-07-11
Status: Received

References

Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.

← Back to all records

CVE-2026-6804

At a glance

CVSS / EPSS / KEV

Description

Record details

References

Related records

Same weakness type (CWE)

Published the same year