CVE-2026-9810

UNKNOWN 0.0

AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.

Vendor	unknown
Product	ai copilot
Published	Jul 17, 2026

Stay Ahead of the Next One

Get instant alerts for unknown ai copilot

Be the first to know when new unknown vulnerabilities affecting unknown ai copilot are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / AI Copilot

0 < 1.5.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/6378a370-fe2f-48e7-984f-6e6c575dba60/

Credits

Khaled Alenazi (Nxploited) WPScan