Live › vulnerability › CVE-2026-110976
Go to dashboardThe AI Engine WordPress plugin before 3.7.9 fails to check that a media action item belongs to the requesting user. An attacker with the Editor role or higher can convert and permanently delete any post, including navigation menus, block templates and global styles.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running AI Engine before 3.7.9 where users hold the Editor role or higher. Exposure depends on those users being able to reach the plugin's media actions; sites with no Editor-level accounts face little risk. Sites that have already updated are not affected.
No product ranges from the sources yet.
wp plugin get ai-engine --field=version3.7.9 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.
This page as .md · .json · in your agent: get_signal("CVE-2026-110976")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.