CVE-2026-59515

CRITICAL

WordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerability

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-59515. PoCs published by incogbyte.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-59515, an unauthenticated blind SQL injection vulnerability in the WordPress plugin 'AI Copilot - Content Generator (AIWU)' <= 1.5.4. The exploit leverages a spoofed IP header (X-Forwarded-For) to inject SQL SLEEP() payloads into unescaped SQL queries, demonstrating the vulnerability via time-based delays.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL Injection.This issue affects AIWU: from n/a through <= 1.5.4.

Exploits (1)

github WORKING POC 3 stars

by incogbyte · pythonpoc

https://github.com/incogbyte/wp-cve-exploits/tree/main/CVE-2026-59515

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2026-59515, an unauthenticated blind SQL injection vulnerability in the WordPress plugin 'AI Copilot - Content Generator (AIWU)' <= 1.5.4. The exploit leverages a spoofed IP header (X-Forwarded-For) to inject SQL SLEEP() payloads into unescaped SQL queries, demonstrating the vulnerability via time-based delays.

Classification

Working Poc 99%

Attack Type

Sqli

Complexity

Moderate

Reliability

Reliable

Target: AI Copilot - Content Generator (AIWU) WordPress plugin <= 1.5.4

No auth needed

Prerequisites: A published AIWU chatbot task with the widget placed on a public page (to scrape nonce and task_id) · Target must trust client-supplied IP headers (default behavior in vulnerable versions)

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

mistral-large-3 · analyzed Jul 14, 2026 Full analysis →

References (1)

Core 1

Core References

Vdb Entry vdb-entry

https://patchstack.com/database/Wordpress/Plugin/ai-copilot-content-generator/vulnerability/wordpress-aiwu-plugin-1-5-4-sql-injection-vulnerability?_s_id=cve

Scores

CVSS v3 9.3

EPSS 0.0024

EPSS Percentile 15.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-89

Status published

Products (1)

Sergey/AIWU < 1.5.4

Published Jul 13, 2026

Tracked Since Jul 13, 2026