CVE-2026-2993

Description

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.17 due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing SQL query in the getListForTbl() function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This issue is partially mitigated by a patch in version 1.4.11 that adds a nonce check for a nonce that is only available to administrators.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/74c71541-6706-43d2-af3d-0655e59f997c?source=cve

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/table.php#L265

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/req.php#L194

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/model.php#L162

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/frame.php#L282

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/controller.php#L157

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/controller.php#L154

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/controller.php#L132

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/controller.php#L114

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/controller.php#L104

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/table.php#L265

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/req.php#L194

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/model.php#L162

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/frame.php#L282

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/controller.php#L157

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/controller.php#L154

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/controller.php#L132

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/controller.php#L114

https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/controller.php#L104

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS