CVE-2026-9810: The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any val
highvulnerability
security
Summary
The AI Copilot WordPress plugin before version 1.5.4 has a security flaw where OAuth access tokens (temporary credentials that grant access to accounts) are not properly tied to specific WordPress users, allowing attackers who complete the public login process to gain administrator privileges and perform dangerous actions like creating new users or changing user permissions.
Solution / Mitigation
Update the AI Copilot WordPress plugin to version 1.5.4 or later.
Vulnerability Details
EPSS (30-day exploit probability)
EPSS: 0.0%
Disclosure Date
July 17, 2026
Classification
Attack Type
Jailbreak
Attack SophisticationModerate
Impact (CIA+S)
integrityconfidentiality
Taxonomy References
MITRE ATLAS (AI/ML Threat Technique)
Affected Vendors
Related Issues
Monthly digest — independent AI security research
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-9810
First tracked: July 17, 2026 at 08:08 AM
Classified by LLM (prompt v3) · confidence: 75%