CVE-2026-6639 wupsales CVE debrief

Who should care

WordPress administrators and users of the AI Chatbot & Workflow Automation by AIWU plugin, as well as developers and security teams responsible for managing and securing WordPress installations, should be aware of this vulnerability. They should review and update the getCurrentTaskResults() method in modules/workspace/controller.php to include authentication and authorization checks, remove OpenAI API keys and other sensitive data from task parameters, and implement secure storage and handling of API keys and sensitive configuration data to prevent unauthorized access to sensitive information.

Technical summary

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure due to the getCurrentTaskResults() method in modules/workspace/controller.php being accessible without authentication or authorization checks. Task parameters, including OpenAI API keys, are stored in plaintext in the database and returned in JSON responses. This allows unauthenticated attackers to enumerate sequential task IDs and retrieve sensitive configuration data, including API keys. Immediate review of task parameters and API key management is recommended to prevent unauthorized access to sensitive information.

Defensive priority

Unauthenticated attackers may enumerate sequential task IDs and retrieve sensitive configuration data, including API keys. Immediate review of task parameters and API key management is recommended.

Recommended defensive actions

• Review and update the getCurrentTaskResults() method in modules/workspace/controller.php to include authentication and authorization checks.
• Remove OpenAI API keys and other sensitive data from task parameters.
• Implement secure storage and handling of API keys and sensitive configuration data.
• Monitor for and restrict unauthorized access to task parameters and API keys.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress stores task parameters, including OpenAI API keys, in plaintext in the database and returns them in JSON responses without proper access controls. The getCurrentTaskResults() method in modules/workspace/controller.php is accessible without authentication or authorization checks, allowing unauthenticated attackers to enumerate sequential task IDs and retrieve sensitive configuration data, including API keys. To verify, defenders should review task parameters, API key management, and implement secure storage and handling of API keys and sensitive configuration data.

Official resources