CVE-2026-27407: WordPress AI Engine plugin <= 3.4.9 - Privilege Escalation vulnerability

Synopsis

This is a privilege escalation vulnerability in the Meow Apps AI Engine WordPress plugin, affecting versions 3.4.9 and earlier. The vulnerability is reachable over the network and requires a high-privilege (admin-level) account, meaning an attacker who already holds elevated credentials can abuse this flaw to further expand their access to editor-level or higher permissions. Successful exploitation gives the attacker full read, write, and availability impact on the affected system. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched rebuild available as soon as upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends requests directly to the exposed WordPress instance.

• AuthenticationRequired

  An admin-level (high-privilege) account is required; the attacker must already hold or steal high-privilege credentials before exploiting this flaw.

• Victim interactionNot required

  No victim interaction is needed; the attacker can trigger the vulnerability without any user action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race conditions, or environmental factors to succeed.

Blast Radius

• A successful attacker reads any data accessible to the elevated account, including stored settings, API keys, and user records within the WordPress installation.
• The attacker modifies plugin configuration, user roles, or site content, potentially granting themselves or others persistent elevated access.
• The attacker disrupts service availability, for example by altering or deleting critical plugin or site data that causes the WordPress instance to become unavailable.
• Full confidentiality, integrity, and availability impact means the attacker gains effective control over the affected WordPress environment.