Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2026-75797

AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter

The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Ai Engine Project Wordpress
Products
Ai Engine Wordpress
CVE-2026-75798

AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's configured provider account.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ai Engine Project Wordpress
Products
Ai Engine Wordpress
CVE-2026-75796

AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Ai Engine Project Wordpress
Products
Ai Engine Wordpress
CVE-2026-16955

AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Ai Engine Project Wordpress
Products
Ai Engine Wordpress
CVE-2026-16953

AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie

The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ai Engine Project Wordpress
Products
Ai Engine Wordpress
CVE-2023-51409

WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 1.9.98.

CVSS 3.1 · 10 Critical EPSS 63.1% KEV · Not listed
Vendors
Ai Engine Project Meowapps
Products
Ai Engine Ai Engine
CVE-2024-6451

AI Engine < 2.5.1 - Admin+ RCE

AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file extension of "logs_path", allowing Administrators to change log filetypes from .log to .php.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Ai Engine Project Meowapps
Products
Ai Engine Ai Engine