The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable...
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 修正版 |
|---|---|---|---|
| tigroumeow | AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini |
3.8.4 以前 |
— |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.
出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
参照URL
- web security@wordfence.com
- web security@wordfence.com
- web security@wordfence.com
- web security@wordfence.com
- web security@wordfence.com
- web security@wordfence.com
- web security@wordfence.com
- web nvd.nist.gov
- web github.com