CVE-2026-107745
AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter
Using AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini by tigroumeow?
Get instant alerts when new vulnerabilities affect AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini - before attackers find them.
Description
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.
References (7)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.