6.5
Medium
CVE-2026-89141 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct…
Description
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to access and retrieve the transcribed contents of private audio attachments belonging to other users, including Administrators, via a supplied attachment ID. This vulnerability requires the Public API module to be enabled in the plugin settings; when disabled, the REST route is absent and the endpoint returns HTTP 404.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| AI Engine – The Chatbot, AI Framework & MCP for WordPress 3.7 | earliest → 3.7.7 | No fix stated |
Other CVEs of AI Engine – The Chatbot, AI Framework & MCP for WordPress
The 14 CVEs of AI Engine – The Chatbot, AI Framework & MCP for WordPress →
CVE-2026-96561
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site…
7.2
High
CVE-2026-15988
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request…
8.8
High
CVE-2026-8719
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation…
8.8
High
CVE-2026-1400
The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file…
7.2
High