Live › vulnerability › CVE-2026-107745
Go to dashboardThe AI Engine WordPress plugin's upload_file function does not validate file paths properly, through versions up to and including 3.8.4. An authenticated user with subscriber-level access can get the server's hourly cleanup task to delete arbitrary media files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Sites running AI Engine up to and including 3.8.4 with the Public API option enabled, where subscriber-level accounts exist. Sites on a later version, or with the Public API option disabled, are not exposed according to the sources.
No product ranges from the sources yet.
3.8.4 in the WordPress plugin list or the plugin's main file header.3.8.4.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.
This page as .md · .json · in your agent: get_signal("CVE-2026-107745")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.