All vulnerabilities
CVE-2026-107745

AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter

tigroumeow AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & GeminiApplications & CMS
Open in ThreatlineRecord JSON
CVSS
4.2Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version yet
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.

Text from CVE List

Affected versions 1

  • AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Geminiaffected: all versions through 3.8.4CVE List

References 7