CVE-2026-16954 AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens
Editors can read stored API keys and tokens in cleartext due to missing redaction in admin scripts, exposing sensitive third-party credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16954?
CVE-2026-16954 is a medium-severity vulnerability in Unknown AI Engine, published on 6 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.
Weakness: CWE-200
Which versions are affected by CVE-2026-16954?
How do I fix CVE-2026-16954?
No fix has been published for CVE-2026-16954 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-16954 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-16954 exists.
Sources
Also known as GHSA-9wjr-j39x-f62m.