WordPress AI Copilot – Content Generator plugin <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Kazuma Matsumoto in WordPress Plugin AIWU versions = 1.4.6...

A week in security (July 27 – August 2)

Last week on Malwarebytes Labs: Fake Fortnite rewards are stealing players’ accounts Fake Flash Player installs AtlasRAT Malwarebytes for Windows, now available on the Microsoft Store Hims & Hers sued over alleged health data privacy failures Hidden prompt turns Microsoft Copilot into an AI worm...

Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents

Hidden instructions in a Word document can make Microsoft 365 Copilot rewrite figures in a report, then copy the same instructions into the finished file. Håkon Måløy disclosed the technique on July 28, 144 days after reporting it to Microsoft. In his proof of concept, the internally generated fi...

CVE-2026-16530

A flaw was found in the PCP Performance Co-Pilot pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service...

GHSA-4JWF-M4WG-8P66 Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

Summary kiota plugin add / kiota plugin generate with -t APIPlugin emits an attacker-controlled statictemplate.file path from the AI-plugin extensions x-ai-adaptive-card, x-ai-capabilities verbatim, with no path validation, into the generated Microsoft 365 Copilot / Teams plugin manifest...

Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

Summary kiota plugin add / kiota plugin generate with -t APIPlugin emits an attacker-controlled statictemplate.file path from the AI-plugin extensions x-ai-adaptive-card, x-ai-capabilities verbatim, with no path validation, into the generated Microsoft 365 Copilot / Teams plugin manifest...

EUVD-2026-44935

Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai- extensions...

WordPress AI Copilot – Content Generator plugin <= 1.5.4 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin AIWU versions = 1.5.4...

CVE-2026-50517

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...

EUVD-2026-48457

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...

CVE-2026-50517 Microsoft M365 Copilot Remote Code Execution Vulnerability

...

CVE-2026-50517

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...

CVE-2026-50517 Microsoft M365 Copilot Remote Code Execution Vulnerability

...

CVE-2026-50517

CVE-2026-50517 describes a deserialization vulnerability in Microsoft 365 Copilot (M365 Copilot) that enables an authorized attacker to execute code over the network. The issue is triggered by deserializing untrusted data, with a critical CVSS v3.1 score (9.9, CRITICAL) and a network attack vecto...

CVE-2026-50517: Deserialization of Untrusted Data

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...

PT-2026-64203

Name of the Vulnerable Software and Affected Versions Microsoft M365 Copilot affected versions not specified Description Deserialization of untrusted data allows an authorized attacker to execute code over a network. Deserialization is the process of converting a data stream back into an object,...

Microsoft M365 Copilot Remote Code Execution Vulnerability

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...

CVE-2026-13009

The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2026-13009 AI Copilot <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter

The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2026-13009 AI Copilot <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter

The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...