Is CVE-2026-27407 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27407 being exploited in the wild.

How severe is CVE-2026-27407?

High severity, with a CVSS score of 7.2, published 15 June 2026.

Is there a fix for CVE-2026-27407?

A patch was published on 2026-05-28: Version 3.5.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27407 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-27407?

Check whether you run Meow Apps AI Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27407: Meow Apps AI Engine privilege escalation in WordPress plugin

CVE-2026-27407 · Severity: high · CVSS 7.2 · Published 2026-06-15

The AI Engine plugin for WordPress, which integrates artificial intelligence features into websites, contains a security flaw that allows users with 'Editor' roles to gain unauthorized administrative privileges. If exploited, a trusted user with limited access could take full control of the website, potentially leading to data theft, site defacement, or complete service disruption. This vulnerability is particularly concerning for sites that rely on multiple staff members for content management.

Technologies: Meow Apps AI Engine. Vendors: Meow Apps.

Quick answers

Is CVE-2026-27407 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27407 being exploited in the wild.
How severe is CVE-2026-27407?: High severity, with a CVSS score of 7.2, published 15 June 2026.
Which products and versions are affected?: Meow Apps AI Engine <= 3.4.9.
Is there a fix for CVE-2026-27407?: A patch was published on 2026-05-28: Version 3.5.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27407 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-27407?: Check whether you run Meow Apps AI Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in the Meow Apps AI Engine plugin for WordPress (versions 3.4.9 and below) due to incorrect privilege assignment (CWE-266). The flaw allows a remote attacker with high-level authenticated access (specifically the 'Editor' role) to bypass intended permission restrictions and escalate their privileges to 'Administrator'. This is achieved via a network request without requiring user interaction. Successful exploitation grants the attacker full control over the WordPress environment. The issue is resolved in version 3.5.0.

Affected products

Meow Apps AI Engine <= 3.4.9

Timeline

2025-11-06: other: Reported by Phat RiO
2026-05-28: disclosed: Vulnerability disclosed by Patchstack
2026-05-28: patched: Version 3.5.0 released
2026-06-15: advisory: NVD published CVE-2026-27407

References

https://patchstack.com/database/wordpress/plugin/ai-engine/vulnerability/wordpress-ai-engine-plugin-3-4-9-privilege-escalation-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.