WordPress AI Engine Plugin Lacks Authorization Checks

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-75796 exploits a critical authorization bypass in the AI Engine WordPress plugin versions before 3.6.1. The vulnerability allows users with Administrator privileges on a WordPress Multisite sub-site to perform privileged user management operations without proper authorization verification, enabling them to hijack accounts across the entire network—including the Network Administrator account. This flaw is particularly dangerous in multi-tenant WordPress environments where site administrators should have isolated permissions. Organizations running WordPress Multisite installations with the AI Engine plugin are directly affected, and the high CVSS score of 7.2 reflects the severity of lateral privilege escalation and account takeover risks.

Casky's 224 mapped skills leverage Claude's extended reasoning to identify the attack patterns underlying this vulnerability, which aligns with MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would detect suspicious patterns such as unauthorized account modifications originating from sub-site administrator contexts, cross-site permission changes without proper authorization workflows, and anomalous user management API calls lacking credential verification. The platform's security skill set would flag missing authorization checks in user management functions, improper trust assumptions between multisite contexts, and insufficient role-based access control (RBAC) enforcement—enabling teams to identify exploitation attempts before accounts are compromised and to prioritize remediation of unverified plugin versions in their WordPress environments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-75796.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-75796

Casky has 224 skills that investigate the attack patterns behind CVE-2026-75796. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn