CVE-2026-6639: unauth leak of stored OpenAI keys

CISO Take

The AI Chatbot & Workflow Automation (AIWU) plugin for WordPress exposes an AJAX endpoint, getCurrentTaskResults(), with no authentication or authorization check, letting anyone enumerate sequential task IDs and pull back the full task record — including the site owner's OpenAI API key in plaintext, plus the prompts and keyword inputs used to generate content. Any WordPress site running AIWU up to 1.4.6 that has used a bulk-generation feature is effectively broadcasting its LLM credentials to unauthenticated internet scanners; CVSS 7.5 (network, no privileges, no user interaction) reflects a trivial, wormable exploitation path even though EPSS sits low (0.37%, ~70th percentile) and there's no KEV listing or public PoC yet. The real business risk is downstream: a leaked OpenAI key enables usage-based cost harvesting, quota exhaustion, or pivoting into whatever other systems that key touches, and the leaked prompts/keywords can reveal proprietary content strategy or internal workflows. There is no patched version referenced in the plugin's changeset trail available here, so the concrete action is to disable or uninstall AIWU until a fixed release confirms the getNoncedMethods()/getPermissions() gap is closed, rotate any OpenAI API key ever entered into the plugin, and audit outbound OpenAI usage/billing for anomalies as an indicator of prior compromise.

Sources: NVD EPSS CISA KEV ATLAS wordfence.com

What is the risk?

High-confidence, low-effort exploitation: the vulnerability requires nothing more than an HTTP request to admin-ajax.php with a guessed/enumerated task ID, since the method sits outside getNoncedMethods(), the controller's getPermissions() returns empty, and the AJAX hook is registered nopriv. Attack complexity is low and no user interaction is needed (CVSS AV:N/AC:L/PR:N/UI:N), yielding a confidentiality-only impact (C:H/I:N/A:N). Real-world exploitation likelihood is currently modest — EPSS is 0.37% (top 70th percentile, not top-tier), it's not in CISA KEV, and CISA's SSVC decision is TRACK rather than Act/Attend, with no public exploit or Nuclei template yet. However, the trivial mechanics (sequential ID enumeration, no auth) mean weaponization is straightforward once attackers notice the plugin is popular enough to scan for, and the payoff — live LLM API keys — is high-value for opportunistic credential harvesters.

How does the attack unfold?

Discovery

Attacker fingerprints a WordPress site as running the AIWU plugin and locates its admin-ajax.php AI workflow actions.

AML.T0006

Unauthenticated Exploitation

Attacker sends unauthenticated AJAX requests to getCurrentTaskResults() while enumerating sequential task IDs.

AML.T0049

Credential Extraction

The response returns stored task data including the plaintext OpenAI API key, prompts, and model configuration.

AML.T0055

Impact

Attacker reuses the harvested OpenAI key to run workloads at the victim's expense or pivot to further data exposure.

AML.T0034

Discovery

Attacker fingerprints a WordPress site as running the AIWU plugin and locates its admin-ajax.php AI workflow actions.

AML.T0006

Unauthenticated Exploitation

Attacker sends unauthenticated AJAX requests to getCurrentTaskResults() while enumerating sequential task IDs.

AML.T0049

Credential Extraction

The response returns stored task data including the plaintext OpenAI API key, prompts, and model configuration.

AML.T0055

Impact

Attacker reuses the harvested OpenAI key to run workloads at the victim's expense or pivot to further data exposure.

AML.T0034

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Until the vendor ships and confirms a version beyond 1.4.6 that adds getCurrentTaskResults() to getNoncedMethods() or otherwise enforces authorization in getPermissions(), the safest step is to deactivate the AIWU plugin or block unauthenticated access to the relevant admin-ajax.php action at the web server/WAF layer. Immediately rotate any OpenAI API key that was ever configured in AIWU, since it may already be exposed. Review OpenAI billing/usage dashboards for unexpected activity as a compromise indicator. For detection, monitor admin-ajax.php access logs for repeated unauthenticated requests referencing workspace/task actions with sequentially incrementing IDs — a signature of ID-enumeration probing. Longer term, avoid storing API keys in plaintext task-level configuration; prefer WordPress secrets management or environment-level key storage decoupled from per-task records.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Auth Bypass Data Extraction Plugin API AML.T0036 - Data from Information Repositories AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.3 - AI System Security

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-6639?

The AI Chatbot & Workflow Automation (AIWU) plugin for WordPress exposes an AJAX endpoint, getCurrentTaskResults(), with no authentication or authorization check, letting anyone enumerate sequential task IDs and pull back the full task record — including the site owner's OpenAI API key in plaintext, plus the prompts and keyword inputs used to generate content. Any WordPress site running AIWU up to 1.4.6 that has used a bulk-generation feature is effectively broadcasting its LLM credentials to unauthenticated internet scanners; CVSS 7.5 (network, no privileges, no user interaction) reflects a trivial, wormable exploitation path even though EPSS sits low (0.37%, ~70th percentile) and there's no KEV listing or public PoC yet. The real business risk is downstream: a leaked OpenAI key enables usage-based cost harvesting, quota exhaustion, or pivoting into whatever other systems that key touches, and the leaked prompts/keywords can reveal proprietary content strategy or internal workflows. There is no patched version referenced in the plugin's changeset trail available here, so the concrete action is to disable or uninstall AIWU until a fixed release confirms the getNoncedMethods()/getPermissions() gap is closed, rotate any OpenAI API key ever entered into the plugin, and audit outbound OpenAI usage/billing for anomalies as an indicator of prior compromise.

Is CVE-2026-6639 actively exploited?

No confirmed active exploitation of CVE-2026-6639 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-6639?

Until the vendor ships and confirms a version beyond 1.4.6 that adds getCurrentTaskResults() to getNoncedMethods() or otherwise enforces authorization in getPermissions(), the safest step is to deactivate the AIWU plugin or block unauthenticated access to the relevant admin-ajax.php action at the web server/WAF layer. Immediately rotate any OpenAI API key that was ever configured in AIWU, since it may already be exposed. Review OpenAI billing/usage dashboards for unexpected activity as a compromise indicator. For detection, monitor admin-ajax.php access logs for repeated unauthenticated requests referencing workspace/task actions with sequentially incrementing IDs — a signature of ID-enumeration probing. Longer term, avoid storing API keys in plaintext task-level configuration; prefer WordPress secrets management or environment-level key storage decoupled from per-task records.

What systems are affected by CVE-2026-6639?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM API integrations, CMS/plugin-embedded AI workflows.

What is the CVSS score for CVE-2026-6639?

CVE-2026-6639 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.37%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM API integrationsCMS/plugin-embedded AI workflows

MITRE ATLAS Techniques

AML.T0036 Data from Information Repositories

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the `getCurrentTaskResults()` method in `modules/workspace/controller.php` being accessible without authentication or authorization checks. The method is not included in the workspace controller's `getNoncedMethods()` array, the base `getPermissions()` returns an empty array, and all AJAX actions are registered with `wp_ajax_nopriv_` hooks (`classes/frame.php:282`). When tasks are created via features like the Bulk Post Generator, the task parameters — including the OpenAI API key in plaintext, AI prompts, keywords, and full AI model configuration — are stored in the database and returned in the JSON response. This makes it possible for unauthenticated attackers to enumerate sequential task IDs and retrieve sensitive configuration data including API keys.

Exploitation Scenario

An attacker identifies a WordPress site running the AIWU plugin (via plugin fingerprinting or a mass scan of the wp-content/plugins/ai-copilot-content-generator path). They send unauthenticated POST requests to admin-ajax.php invoking the getCurrentTaskResults action, incrementing a numeric task ID parameter on each request. For any site that has generated bulk content, one or more responses return the full task JSON, including the site's OpenAI API key, the prompts/keywords used, and model configuration. The attacker then uses the harvested API key directly against OpenAI's API — either to run their own workloads at the victim's expense (cost harvesting) or to exfiltrate further data if the key has broader scope — while the victim organization has no visibility into the theft until anomalous billing or usage appears.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.