5.0
Medium
CVE-2026-16955 The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and…
Description
The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| AI Engine 3.6 | earliest → < 3.6.6 | 3.6.6 |
References
- wpscan.com wpscan.com
Timeline
- Published
- Last modified
Other CVEs of AI Engine
The 14 CVEs of AI Engine →
CVE-2026-110982
The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object…
4.9
Medium
CVE-2026-111041
The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management…
4.9
Medium
CVE-2026-110976
The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs…
4.9
Medium
CVE-2026-75798
The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only…
5.3
Medium