Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-107745EUVD-2026-111565GHSA-XFC5-7GQH-V42G

AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter

Published
Last modified
published
Not listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

The AI Engine WordPress plugin, which provides chatbot and AI features, is affected by a flaw that lets logged-in users with basic subscriber-level accounts delete some media files stored on the website's server. The impact is limited to media files, and it only applies when the site's Public API option is enabled.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  4. Record last updated

Affected versions

  • tigroumeow AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini

    through 3.8.4

References 7

wordfence.com

plugins.trac.wordpress.org