CVE-2026-13009: AI Copilot Content Generator plugin SQL injection via order parameter

Summary

CVE-2026-13009 affects the AI Copilot – Content Generator WordPress plugin in all versions up to and including 1.5.4. Insufficient escaping of the order[0][dir] parameter and a lack of prepared statements allow authenticated attackers with subscriber-level access or higher to append SQL queries to existing ones and extract sensitive database information. The waic-nonce is exposed on the front-end when the [waic_form] or [aiwu-form] shortcode renders, so contributor-level users who can publish shortcodes can obtain it and reach the vulnerable AJAX handler, which checks only the nonce when the shortcodes are not already embedded in a page.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Coding assistants

Related items

• MediumARTEX and beyond: AI-enabled penetration testing platformsSimilar attack · Cisco Talos Blog
• InfoHow AI is changing the nature of cyberattacksSimilar attack · CSO Online
• MediumInside the loop: Five AI attack frameworks that never ask permissionSimilar attack · Elastic Security Labs
• MediumARTEX: Attackers Adopted This AI Pentesting Tool in Three Months. Leaked Secrets Are Its Fastest Way In.Similar attack · StepSecurity Blog
• MediumFBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video CallsSimilar attack · The Hacker News