Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-08-26
AI Engine - Security Vulnerability (CVE-2026-75797)
The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.
PLUGIN
AI Engine
CVE-2026-75797
Risk Score
Threat Entry
Updated 2026-08-26
AI Engine - Security Vulnerability (CVE-2026-75798)
The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's configured provider account.
PLUGIN
AI Engine
CVE-2026-75798
Risk Score
Threat Entry
Updated 2026-08-26
AI Engine - Broken Access Control (CVE-2026-75796)
The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.
PLUGIN
AI Engine
CVE-2026-75796
Risk Score
Threat Entry
Updated 2026-08-26
AI Engine - Security Vulnerability (CVE-2026-16955)
The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.
PLUGIN
AI Engine
CVE-2026-16955
Risk Score
Threat Entry
Updated 2026-08-26
AI Engine - Security Vulnerability (CVE-2026-16953)
The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.
PLUGIN
AI Engine
CVE-2026-16953
Risk Score
Threat Entry
Updated 2026-08-12
AI Engine - Cross-Site Scripting (XSS) (CVE-2026-65545)
Unauthenticated Cross Site Scripting (XSS) in AI Engine
PLUGIN
AI Engine
CVE-2026-65545
Risk Score
Threat Entry
Updated 2026-08-26
AI Engine - Security Vulnerability (CVE-2026-16954)
The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.
PLUGIN
AI Engine
CVE-2026-16954
Risk Score
Threat Entry
Updated 2026-08-12
Ai Engine - Authentication Bypass (CVE-2026-15988)
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauth_for_authorize function. This makes it possible for unauthenticated attackers to create new administrator accounts with attacker-supplied credentials via a CSRF-based REST authentication bypass, granted they can trick a site administrator into performing an action such as clicking on a link. This bypass can be combined with WordPress's ?_method=POST method-override support…
PLUGIN
Ai Engine
CVE-2026-15988
Risk Score
Threat Entry
Updated 2026-07-16
AI Engine - Broken Access Control (CVE-2026-12510)
The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled.
PLUGIN
AI Engine
CVE-2026-12510
Risk Score
Threat Entry
Updated 2026-07-14
AI Engine - Path Traversal (CVE-2026-12511)
The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.
PLUGIN
AI Engine
CVE-2026-12511
Risk Score
Threat Entry
Updated 2026-06-17
AI Engine - Privilege Escalation (CVE-2026-27407)
Editor Privilege Escalation in AI Engine
PLUGIN
AI Engine
CVE-2026-27407
Risk Score
Threat Entry
Updated 2026-06-17
AI Engine - Privilege Escalation (CVE-2026-8719)
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any valid OAuth token causes MCP access to be granted without verifying administrator privileges. This makes it possible for authenticated (Subscriber+) attackers to invoke admin-level MCP tools and escalate privileges to Administrator.
PLUGIN
AI Engine
CVE-2026-8719
Risk Score
Threat Entry
Updated 2026-06-17
Ai Engine - Arbitrary File Upload (CVE-2026-23802)
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine ai-engine allows Using Malicious Files.This issue affects AI Engine: from n/a through
PLUGIN
Ai Engine
CVE-2026-23802
Risk Score
Threat Entry
Updated 2026-06-17
Ai Engine - Remote Code Execution (CVE-2026-1400)
The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `rest_helpers_update_media_metadata` function in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The attacker can upload a benign image file, then use the `update_media_metadata` endpoint to rename it to a PHP file, creating an executable PHP…
PLUGIN
Ai Engine
CVE-2026-1400
Risk Score
Threat Entry
Updated 2026-06-17
Ai Engine - Server-Side Request Forgery (SSRF) (CVE-2026-0746)
The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the 'get_audio' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, if "Public API" is enabled in the plugin settings, and 'allow_url_fopen' is set to 'On' on the server.
PLUGIN
Ai Engine
CVE-2026-0746
Risk Score
Threat Entry
Updated 2026-06-17
Ai Engine - Server-Side Request Forgery (SSRF) (CVE-2025-8084)
The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.8 via the rest_helpers_create_images function. This makes it possible for authenticated attackers, with Editor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On Cloud instances, this issue allows for metadata retrieving.
PLUGIN
Ai Engine
CVE-2025-8084
Risk Score
Threat Entry
Updated 2026-06-17
Ai Engine - PHP Object Injection (CVE-2025-12844)
The AI Engine plugin for WordPress is vulnerable to PHP Object Injection via PHAR Deserialization in all versions up to, and including, 3.1.8 via deserialization of untrusted input in the 'rest_simpleTranscribeAudio' and 'rest_simpleVisionQuery' functions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an…
PLUGIN
Ai Engine
CVE-2025-12844
Risk Score
Threat Entry
Updated 2026-06-17
Ai Engine - Privilege Escalation (CVE-2025-11749)
The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract the bearer token, which can be used to gain access to a valid session and perform many actions like creating a new administrator account, leading to privilege escalation.
PLUGIN
Ai Engine
CVE-2025-11749
Risk Score
Threat Entry
Updated 2026-06-17
Ai Engine - Broken Access Control (CVE-2025-8268)
The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the rest_list and delete_files functions in all versions up to, and including, 2.9.5. This makes it possible for unauthenticated attackers to list and delete files uploaded by other users.
PLUGIN
Ai Engine
CVE-2025-8268
Risk Score
Threat Entry
Updated 2026-06-17
Ai Engine - Remote Code Execution (CVE-2025-7847)
The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_simpleFileUpload() function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server when the REST API is enabled, which may make remote code execution possible.
PLUGIN
Ai Engine
CVE-2025-7847
Risk Score