CVE-2026-6639: The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all
highvulnerabilityLLM-Specific
security
Summary
The AI Chatbot & Workflow Automation by AIWU WordPress plugin has a security flaw (in versions up to 1.4.6) where a method called `getCurrentTaskResults()` can be accessed by anyone without logging in, allowing them to retrieve sensitive data like OpenAI API keys (credentials that grant access to AI services) stored in plaintext in the database. Attackers can guess sequential task IDs to find and steal this configuration information.
Vulnerability Details
CVSS Score
7.5(high)
EPSS (30-day exploit probability)
EPSS: 0.0%
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
network
Attack Complexity
low
Privileges Required
none
User Interaction
none
Disclosure Date
August 5, 2026
Classification
Attack Type
PII Leakage
Attack SophisticationTrivial
Impact (CIA+S)
confidentiality
AI Component TargetedAPI
Affected Vendors
OpenAI
Related Issues
Monthly digest — independent AI security research
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-6639
First tracked: August 5, 2026 at 08:08 AM
Classified by LLM (prompt v3) · confidence: 92%