WordPress security by component

AI Engine

AI Engine (ai-engine) is a WordPress plugin with 35 published CVE records in this archive. The latest tracked vulnerability was published Sep 15, 2026; the highest published CVSS base score is 10.

Plugin slug: ai-engine

Latest vulnerability

CVE-2026-89141: AI Engine lets subscribers transcribe private audio belonging to other users

AI Engine through 3.7.7 accepts a caller-controlled mediaId without verifying that the caller can read the selected attachment. When the Public API module is enabled, an authenticated Subscriber or higher can supply another user's private audio attachment ID and retrieve its transcribed contents, including audio belonging to administrators. With that module disabled, the affected REST route is absent and returns HTTP 404. The export does not disclose the full REST route or callback name. The official 3.7.8 changelog confirms that transcription and image-edit endpoints now check the caller's read permission on supplied attachments, matching the reported flaw.

PublishedSep 15, 2026

Known safe version3.7.8

Published vulnerabilities for ai-engine
		Safe version
Sep 15, 2026	CVE-2026-89141 AI Engine lets subscribers transcribe private audio belonging to other users AI Engine through 3.7.7 accepts a caller-controlled mediaId without verifying that the caller can read the selected attachment. When the Public API module is enabled, an authenticated Subscriber or higher can supply another user's private audio attachment ID and retrieve its transcribed contents, including audio belonging to administrators. With that module disabled, the affected REST route is absent and returns HTTP 404. The export does not disclose the full REST route or callback name. The official 3.7.8 changelog confirms that transcription and image-edit endpoints now check the caller's read permission on supplied attachments, matching the reported flaw.	3.7.8	CVE6.5 NVDPending
Aug 26, 2026	CVE-2026-75798 AI Engine exposes site-owner AI capacity to anonymous callers AI Engine before 3.7.2 protects an administration-only AI feature with a token distributed to anonymous visitors instead of an authorization check. An unauthenticated attacker can submit chosen AI queries against the site owner's configured provider account.	3.7.2	CVE5.3 NVDPending
Aug 26, 2026	CVE-2026-75797 AI Engine permits arbitrary local file read and off-site exfiltration AI Engine before 3.7.2 maps a caller-supplied URL to a local path without confining it, reads the selected file, and forwards its contents to an external service. A Subscriber can exploit this when the non-default public API is enabled; otherwise an Administrator can reach it, including a multisite subsite administrator reading network-shared secrets.	3.7.2	CVE7.7 NVDPending
Aug 21, 2026	CVE-2026-75796 AI Engine lets sub-site administrators take over network accounts AI Engine from 2.8.0 through 3.6.0 does not verify that the requester may act on the targeted account before performing privileged user-management operations. On WordPress Multisite, an Administrator of a sub-site can target any network account, including the Network Administrator, and take it over.	3.6.1	CVE7.2 NVDPending
Aug 08, 2026	CVE-2026-16955 AI Engine audio transcription route can read and exfiltrate local files AI Engine before 3.6.6 accepts POST requests to /wp-json/mwai/v1/ai/transcribe_audio and passes raw parameters through simpleTranscribeAudio() and inject_params(), which can restore an attacker-controlled local path on the transcription query. The ChatML transcription path reads that file with file_get_contents() and sends its contents to the configured AI provider. A Subscriber can exploit this when the plugin's non-default Public API option is enabled; otherwise the route requires the plugin settings capability, normally Administrator. On multisite, a subsite Administrator can use the flaw to read network-level files such as wp-config.php.	3.6.6	CVE5.0 NVDPending
Aug 08, 2026	CVE-2026-16953 AI Engine guessable guest sessions permit deletion of another visitor's uploaded files AI Engine exposes POST /wp-json/mwai-ui/v1/files/delete for guest file management. rest_delete() accepts file references in the files JSON field and authorizes them against the guest identity derived from the mwai_session_id cookie. Vulnerable releases generated that identity with predictable PHP uniqid() output and used it as the guest-file ownership key. An unauthenticated attacker who can obtain or enumerate a victim session identifier and knows a victim file reference can submit that identity and delete the victim's plugin-managed chatbot uploads. The CNA identifies 3.6.4 as fixed, but that release still accepted arbitrary legacy 13-hex session identifiers; official source removes that compatibility path in 3.6.6.	3.6.6	CVE4.8 NVDPending
Aug 06, 2026	CVE-2026-65545 AI Engine permits unauthenticated cross-site scripting An unauthenticated visitor can submit attacker-controlled content that AI Engine 3.6.8 and earlier renders without sufficient output encoding.	3.6.9	CVE7.1 NVDPending
Aug 06, 2026	CVE-2026-16954 AI Engine exposes stored provider credentials to Editors AI Engine before 3.6.4 exposes its complete option set to users who may access plugin features, including Editors, by placing Meow_MWAI_Admin::admin_enqueue_scripts() data into localized inline options on wp-admin pages. Although the settings screen itself requires manage_options, the localized data includes third-party API keys and bearer/authentication tokens in cleartext. An Editor can read those credentials from page source and use them outside WordPress within the provider or token's privileges. The exact generated JavaScript variable name is not established by the CNA.	3.6.4	CVE6.5 NVDPending
Aug 01, 2026	CVE-2026-15988 AI Engine reauthorization can turn an administrator click into account creation AI Engine through 3.6.5 does not correctly validate a nonce in reauth_for_authorize. An unauthenticated attacker can send an administrator a crafted link that combines this CSRF path with WordPress's ?_method=POST override, converting a top-level GET navigation into an authenticated POST to the REST users endpoint. If the logged-in administrator follows it, WordPress creates a new Administrator account using attacker-supplied credentials; the attacker needs no existing site account but does require that administrator interaction.	3.6.6	CVE8.8 NVDPending
Jul 16, 2026	CVE-2026-12510 AI Engine: A security weakness AI Engine is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 3.5.5.	3.5.5	CVE5.9 NVDPending
Jul 14, 2026	CVE-2026-12511 AI Engine: Filesystem traversal AI Engine is affected by filesystem traversal. Exploitation requires an authenticated editor account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is < 3.5.5.	3.5.5	CVE8.1 NVDPending
Jun 15, 2026	CVE-2026-27407 AI Engine: Privilege escalation or authentication bypass AI Engine is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated editor account. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 3.4.9.	3.5.0	CVE7.2 NVDPending
Mar 05, 2026	CVE-2026-23802 AI Engine: Dangerous file upload AI Engine is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE9.1 NVDPending
Jan 28, 2026	CVE-2026-1400 AI Engine – The Chatbot and AI Framework for: Dangerous file upload AI Engine – The Chatbot and AI Framework for is affected by dangerous file upload. Exploitation requires an authenticated editor account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE7.2 NVDPending
Jan 27, 2026	CVE-2026-0746 AI Engine: Server-side request forgery AI Engine is affected by server-side request forgery. Exploitation requires an authenticated subscriber account. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE6.4 NVDPending
Nov 18, 2025	CVE-2025-8084 AI Engine: Server-side request forgery AI Engine is affected by server-side request forgery. Exploitation requires an authenticated editor account. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE6.8 NVDPending
Nov 13, 2025	CVE-2025-12844 AI Engine: Code execution AI Engine is affected by code execution. Exploitation requires an authenticated subscriber account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE7.1 NVDPending
Nov 05, 2025	CVE-2025-11749 AI Engine: Privilege escalation or authentication bypass AI Engine is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE9.8 NVDPending
Sep 03, 2025	CVE-2025-8268 AI Engine: A security weakness AI Engine is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5 NVDPending
Jul 31, 2025	CVE-2025-7847 AI Engine: Dangerous file upload AI Engine is affected by dangerous file upload. Exploitation requires an authenticated subscriber account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE8.8 NVDPending
Jul 24, 2025	CVE-2025-7780 AI Engine: Sensitive information exposure AI Engine is affected by sensitive information exposure. Exploitation requires an authenticated subscriber account. Successful exploitation can disclose data that should not be available to the caller.	See mitigation notes	CVE6.5 NVDPending
Jul 08, 2025	CVE-2025-5570 AI Engine: Cross-site scripting AI Engine is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.4 NVDPending
Jul 04, 2025	CVE-2025-6238 AI Engine: An open redirect AI Engine is affected by an open redirect. The vulnerable path is reachable without authentication. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination.	See mitigation notes	CVE8.0 NVDPending
Jun 19, 2025	CVE-2025-5071 AI Engine: Privilege escalation or authentication bypass AI Engine is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE8.8 NVDPending
Dec 12, 2024	CVE-2024-10499 AI Engine: SQL injection AI Engine is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE7.2 NVDPending
Sep 13, 2024	CVE-2024-6723 AI Engine: SQL injection AI Engine is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE4.7 NVD4.7
Aug 19, 2024	CVE-2024-6451 AI Engine: A security weakness AI Engine is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.2 NVDPending
Aug 01, 2024	CVE-2024-38791 AI Engine: ChatGPT Chatbot: Server-side request forgery AI Engine: ChatGPT Chatbot is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE4.9 NVD7.1
May 14, 2024	CVE-2024-34440 AI Engine: ChatGPT Chatbot: Dangerous file upload AI Engine: ChatGPT Chatbot is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE9.1 NVD7.2
Apr 12, 2024	CVE-2023-51409 AI Engine: ChatGPT Chatbot: Dangerous file upload AI Engine: ChatGPT Chatbot is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE10.0 NVD9.8
Mar 28, 2024	CVE-2024-29100 AI Engine: ChatGPT Chatbot: Dangerous file upload AI Engine: ChatGPT Chatbot is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE9.1 NVD7.2
Mar 28, 2024	CVE-2024-29090 AI Engine: ChatGPT Chatbot: Server-side request forgery AI Engine: ChatGPT Chatbot is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE6.8 NVD6.8
Mar 02, 2024	CVE-2024-0378 AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!: Cross-site scripting AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5 NVD6.1
Feb 05, 2024	CVE-2024-0699 AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!: Dangerous file upload AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! is affected by dangerous file upload. Exploitation requires an authenticated editor account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE6.6 NVD7.2
Jun 27, 2023	CVE-2023-2580 AI Engine: Cross-site scripting AI Engine is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD4.8

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers