UNKNOWN NVD

CVE-2026-16954

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing us

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.

References

https://wpscan.com/vulnerability/badce355-e6ce-4dd4-8d9b-c87a7b9db12f/

Published: 2026-08-06 · Source: NVD · Feed updated: 2026-08-06

This unknown severity vulnerability was published on 2026-08-06 via NVD.

vulnfeed aggregates 9332 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.