AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-104742 · Microsoft / collected KEV context

cve-program · CVE-2026-104742

• https://www.wordfence.com/threat-intel/vulnerabilities/id/58967ac0-d6f7-4cc7-a2e3-4594aa4b2be2?source=cve
• https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/dashboard/ajax/class-aipkit-settings-ajax-handler.php#L137
• https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/dashboard/ajax/class-aipkit-settings-ajax-handler.php#L790
• https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/dashboard/ajax/class-aipkit-base-dashboard-ajax-handler.php#L53
• https://plugins.trac.wordpress.org/browser/gpt3-ai-content-generator/tags/2.4.88/classes/dashboard/class-aipkit_role_manager.php#L275
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3725365%40gpt3-ai-content-generator&new=3725365%40gpt3-ai-content-generator

No related operational record is retained in the current change model.