6.5
Moyenne
CVE-2026-89141 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct…
Description
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to access and retrieve the transcribed contents of private audio attachments belonging to other users, including Administrators, via a supplied attachment ID. This vulnerability requires the Public API module to be enabled in the plugin settings; when disabled, the REST route is absent and the endpoint returns HTTP 404.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| AI Engine – The Chatbot, AI Framework & MCP for WordPress 3.7 | premières → 3.7.7 | Pas de correctif indiqué |
Autres CVE de AI Engine – The Chatbot, AI Framework & MCP for WordPress
Les 14 CVE de AI Engine – The Chatbot, AI Framework & MCP for WordPress →
CVE-2026-96561
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site…
7.2
Élevée
CVE-2026-15988
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request…
8.8
Élevée
CVE-2026-8719
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation…
8.8
Élevée
CVE-2026-1400
The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file…
7.2
Élevée