7.2
High
CVE-2024-6451 AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning
Description
AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file extension of "logs_path", allowing Administrators to change log filetypes from .log to .php.
Affected products and versions
Other CVEs of AI Engine
The 14 CVEs of AI Engine →
CVE-2026-110982
The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object…
4.9
Medium
CVE-2026-111041
The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management…
4.9
Medium
CVE-2026-110976
The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs…
4.9
Medium
CVE-2026-75798
The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only…
5.3
Medium