AI Engine WordPress plugin missing authorization flaw (EUVD-2026-113739)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- tigroumeow
- Product
- AI Engine – MCP Server & AI Chatbot for WordPress
- First seen
Summary
An EUVD entry (EUVD-2026-113739, CVSS v3.1 7.5) says the AI Engine WordPress plugin is vulnerable to missing authorization in all versions up to and including 3.8.6. The item's excerpt is truncated, so the impact is not fully stated.
If you use tigroumeow
Update AI Engine to a version later than 3.8.6
Review plugin settings and chatbot access permissions
Check logs for unexpected plugin actions
Check whether Meow Gallery is installed and confirm its version
Update to a patched version from the plugin author once available
Review gallery permissions and recent media changes for unauthorized actions
What the sources say 4
· Mastodon: “The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6” Source
· Mastodon: “The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action.” Source
· Mastodon: “The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping.” Source
· Mastodon: “The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7.” Source