AI Engine

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/v1/oauth/register) being registered with a permission_callback of __return_true, allowing an unauthenticated user to register an active OAuth client with an attacker-controlled redirect URI. This makes it possible for unauthenticated attackers to obtain an administrator-bound MCP access token, and thereby full administrator-level control through the MCP tools (including user creation and option updates), once an administrator approves the attacker's client on the OAuth consent screen. The consent page is additionally served without X-Frame-Options or Content-Security-Policy frame-ancestors, so that approval can be obtained via clickjacking. The structured affected range is <= 3.8.6.

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload. The structured affected range is <= 3.8.4.

AI Engine <= 3.8.6 has an authorization flaw that lets a low-privilege authenticated user alter protected plugin state, as indicated by the source CVSS confidentiality/integrity impacts. Attacker-controlled requests reach an operation without an adequate permission check. The export does not disclose the endpoint, parameter, affected object, exact minimum WordPress role for authenticated access, or a more specific operation; it does not establish administrator takeover.

The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as navigation menus, block templates, global styles and WooCommerce coupons. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 3.8.6.

The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit. The export supplies no additional endpoint, action, parameter or function details beyond those described above.

The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles. The export supplies no additional endpoint, action, parameter or function details beyond those described above.

Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI Engine: from n/a through 3.8.3. The CNA vector specifies an attacker with low privileges and does not require victim interaction; the exact WordPress role is not identified for authenticated access. An insufficient authorization check exposes an operation or data beyond the caller's intended permissions. The export does not identify the vulnerable endpoint, action, parameter or function.

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the PHP error-log parser (MeowKit_MWAI_Helpers::php_error_logs), the Advisor task (Meow_MWAI_Modules_Advisor::run_advisor), and the Advisor dashboard widget (advisor_metabox): the server-parameter denylist in chat_submit strips only exact key names such as 'model' while convert_keys() later canonicalizes 'model_' back to 'model', allowing an unauthenticated caller to place an attacker-controlled string (including CR/LF) into $query->model; final_checks() throws an Exception whose message embeds that raw string, and the non-streaming, non-admin catch branch writes it to the PHP error log unmodified — creating a forged log line that the plugin's own parser subsequently returns as recent PHP-error content; run_advisor() then appends that content verbatim to the AI prompt (indirect prompt injection — CWE-1427), the returned JSON is stored in the mwai_advisor_data option with no schema validation or HTML sanitization, and advisor_metabox() concatenates the resulting 'title' and 'description' values directly into the WordPress dashboard widget without esc_html(), wp_kses(), or equivalent escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the WordPress dashboard. The official changelog confirms a matching fix in 3.8.1.

An unauthenticated attacker can cross an authorization boundary by influencing the target-object key or reference. The endpoint, identifier, object type and exact permitted read/write operation are unspecified; account takeover is not established. Affected versions: n/a through 3.7.8. Confirmed fixed release: 3.7.9.

AI Engine through 3.7.7 accepts a caller-controlled mediaId without verifying that the caller can read the selected attachment. When the Public API module is enabled, an authenticated Subscriber or higher can supply another user's private audio attachment ID and retrieve its transcribed contents, including audio belonging to administrators. With that module disabled, the affected REST route is absent and returns HTTP 404. The export does not disclose the full REST route or callback name. The official 3.7.8 changelog confirms that transcription and image-edit endpoints now check the caller's read permission on supplied attachments, matching the reported flaw.

AI Engine before 3.7.2 protects an administration-only AI feature with a token distributed to anonymous visitors instead of an authorization check. An unauthenticated attacker can submit chosen AI queries against the site owner's configured provider account.

AI Engine before 3.7.2 maps a caller-supplied URL to a local path without confining it, reads the selected file, and forwards its contents to an external service. A Subscriber can exploit this when the non-default public API is enabled; otherwise an Administrator can reach it, including a multisite subsite administrator reading network-shared secrets.

AI Engine from 2.8.0 through 3.6.0 does not verify that the requester may act on the targeted account before performing privileged user-management operations. On WordPress Multisite, an Administrator of a sub-site can target any network account, including the Network Administrator, and take it over.

AI Engine before 3.6.6 accepts POST requests to /wp-json/mwai/v1/ai/transcribe_audio and passes raw parameters through simpleTranscribeAudio() and inject_params(), which can restore an attacker-controlled local path on the transcription query. The ChatML transcription path reads that file with file_get_contents() and sends its contents to the configured AI provider. A Subscriber can exploit this when the plugin's non-default Public API option is enabled; otherwise the route requires the plugin settings capability, normally Administrator. On multisite, a subsite Administrator can use the flaw to read network-level files such as wp-config.php.

AI Engine exposes POST /wp-json/mwai-ui/v1/files/delete for guest file management. rest_delete() accepts file references in the files JSON field and authorizes them against the guest identity derived from the mwai_session_id cookie. Vulnerable releases generated that identity with predictable PHP uniqid() output and used it as the guest-file ownership key. An unauthenticated attacker who can obtain or enumerate a victim session identifier and knows a victim file reference can submit that identity and delete the victim's plugin-managed chatbot uploads. The CNA identifies 3.6.4 as fixed, but that release still accepted arbitrary legacy 13-hex session identifiers; official source removes that compatibility path in 3.6.6.

An unauthenticated visitor can submit attacker-controlled content that AI Engine 3.6.8 and earlier renders without sufficient output encoding.

AI Engine before 3.6.4 exposes its complete option set to users who may access plugin features, including Editors, by placing Meow_MWAI_Admin::admin_enqueue_scripts() data into localized inline options on wp-admin pages. Although the settings screen itself requires manage_options, the localized data includes third-party API keys and bearer/authentication tokens in cleartext. An Editor can read those credentials from page source and use them outside WordPress within the provider or token's privileges. The exact generated JavaScript variable name is not established by the CNA.

AI Engine through 3.6.5 does not correctly validate a nonce in reauth_for_authorize. An unauthenticated attacker can send an administrator a crafted link that combines this CSRF path with WordPress's ?_method=POST override, converting a top-level GET navigation into an authenticated POST to the REST users endpoint. If the logged-in administrator follows it, WordPress creates a new Administrator account using attacker-supplied credentials; the attacker needs no existing site account but does require that administrator interaction.

AI Engine is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 3.5.5.

AI Engine is affected by filesystem traversal. Exploitation requires an authenticated editor account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is < 3.5.5.

AI Engine is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated editor account. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 3.4.9.

AI Engine is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

AI Engine – The Chatbot and AI Framework for is affected by dangerous file upload. Exploitation requires an authenticated editor account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

AI Engine is affected by server-side request forgery. Exploitation requires an authenticated subscriber account. The vulnerable server can be induced to make attacker-selected network requests.

AI Engine is affected by server-side request forgery. Exploitation requires an authenticated editor account. The vulnerable server can be induced to make attacker-selected network requests.

AI Engine is affected by code execution. Exploitation requires an authenticated subscriber account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

AI Engine is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.

AI Engine is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

AI Engine is affected by dangerous file upload. Exploitation requires an authenticated subscriber account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

AI Engine is affected by sensitive information exposure. Exploitation requires an authenticated subscriber account. Successful exploitation can disclose data that should not be available to the caller.

AI Engine is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

AI Engine is affected by an open redirect. The vulnerable path is reachable without authentication. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination.

AI Engine is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess.

AI Engine is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

AI Engine is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

AI Engine is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

AI Engine: ChatGPT Chatbot is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.

AI Engine: ChatGPT Chatbot is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

AI Engine: ChatGPT Chatbot is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

AI Engine: ChatGPT Chatbot is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

AI Engine: ChatGPT Chatbot is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.

AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! is affected by dangerous file upload. Exploitation requires an authenticated editor account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

AI Engine is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.