Executive brief
A WordPress plugin used for AI-driven chatbot and workflow automation contains a security flaw that allows unauthorized individuals to change the status of website content. An attacker could exploit this to prematurely publish draft posts or take down live content, potentially leading to the exposure of sensitive internal drafts or service disruptions. This issue affects all versions of the plugin up to 1.4.12.
Technical details
The vulnerability is classified as a Missing Authorization (CWE-862) issue within the AI Chatbot & Workflow Automation by AIWU plugin (also known as AI Copilot – Content Generator). The plugin fails to perform adequate authorization checks when processing actions related to post status management. By supplying arbitrary scenario IDs to affected controller endpoints, an unauthenticated remote attacker can bypass intended access controls to publish draft WordPress posts or unpublish live content. The issue is present in versions up to and including 1.4.12; users should update to the latest version to mitigate the risk.
Affected products
- wupsales AI Chatbot & Workflow Automation by AIWU (AI Copilot – Content Generator) up to, and including, 1.4.12
Timeline
- 2026-07-11: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/frame.php
- https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/modules/workspace/controller.php
- https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/modules/workspace/controller.php
- https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/modules/workspace/controller.php
- https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/frame.php
- https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/modules/workspace/controller.php
- https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/modules/workspace/controller.php