{"schema":"threatline.record/2","record":{"id":"CVE-2026-104741","aliases":[],"summary":"AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint","details":"The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify global plugin indexing and vector-search configuration options (aipkit_training_general_settings and aipkit_indexing_field_settings), including chunking parameters, file upload visibility, and per-CPT field indexing settings, affecting all users of the plugin. This is only exploitable in configurations where an administrator has granted 'sources' module access to a lower-privileged role via the plugin's Role Manager.","categories":["Unclassified"],"product":"AI Puffer – AI Chatbot, AI Writer & Automation","vendor":"senols","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104741","source_modified_at":"2026-10-11T16:55:18.339Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"AI Puffer – AI Chatbot, AI Writer & Automation","vendor":"senols","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.4.89","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":3.1,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00269,"percentile":0.18089,"score_date":"2026-10-23"},"published_at":"2026-10-10T05:30:56.935Z","modified_at":"2026-10-11T16:55:18.339Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-104741","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-11T16:55:18.339Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104741","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25ae6c7d-a03c-43f6-9c46-8797a9765d04?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/core/ajax/class-aipkit-core-ajax-handler.php#L883"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/core/ajax/class-aipkit-core-ajax-handler.php#L737"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/dashboard/ajax/class-aipkit-base-dashboard-ajax-handler.php#L53"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/core/ajax/class-aipkit-core-ajax-handler.php#L950"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3725365%40gpt3-ai-content-generator&new=3725365%40gpt3-ai-content-generator"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-11T16:41:03.547230Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-11T16:55:18.339Z","content_hash":"def34991cf51a56e30314eacc823c817192b5e15ef0535c98459b0e801648ac3"}}