The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable...
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| tigroumeow | AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini |
≤ 3.8.4 |
— |
Original description The description as published by the source.
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web security@wordfence.com
- web security@wordfence.com
- web security@wordfence.com
- web security@wordfence.com
- web security@wordfence.com
- web security@wordfence.com
- web security@wordfence.com
- web nvd.nist.gov
- web github.com