{"id":"CVE-2026-110976","kind":"vulnerability","aliases":["CVE-2026-110976"],"related":[],"title":"AI Engine WordPress plugin: editors can permanently delete arbitrary posts and templates","description":"The AI Engine  WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.","summary":"The AI Engine WordPress plugin before 3.7.9 fails to check that a media action item belongs to the requesting user. An attacker with the Editor role or higher can convert and permanently delete any post, including navigation menus, block templates and global styles.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-engine","package","wordpress","wordpress-plugin"],"not_affected_if":["no-editor-role-users","version-3.7.9-or-later"],"how_to_check":"- Check the installed AI Engine version in the WordPress plugins screen or with `wp plugin get ai-engine --field=version`\n- Confirm whether the plugin is active on the site","fix":"- Update AI Engine to `3.7.9` or later\n- Review Editor and higher accounts if the site has untrusted users with those roles","status":"open","published_at":"2026-10-18T07:16:52+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:32:50+00:00","updated_at":"2026-10-25T04:32:50+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-25T04:32:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update AI Engine to `3.7.9` or later\n- Review Editor and higher accounts if the site has untrusted users with those roles","reach":"internet","title":"AI Engine WordPress plugin: editors can permanently delete arbitrary posts and templates","impact":"medium","summary":"The AI Engine WordPress plugin before 3.7.9 fails to check that a media action item belongs to the requesting user. An attacker with the Editor role or higher can convert and permanently delete any post, including navigation menus, block templates and global styles.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","ai-engine"],"confidence":0.75,"needs_auth":"yes","worst_case":"Editor-role user permanently deletes arbitrary site posts and templates","analyst_note":"","how_to_check":"- Check the installed AI Engine version in the WordPress plugins screen or with `wp plugin get ai-engine --field=version`\n- Confirm whether the plugin is active on the site","needs_analyst":false,"not_affected_if":["version-3.7.9-or-later","no-editor-role-users"],"who_is_affected":"Sites running AI Engine before `3.7.9` where users hold the Editor role or higher. Exposure depends on those users being able to reach the plugin's media actions; sites with no Editor-level accounts face little risk. Sites that have already updated are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000595,"input_tokens":3338,"output_tokens":522,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110976':15A,18A '-2026':14A,17A '3.7.9':33B,76C 'action':40B,89C 'ai':1A,20B,28B,71C 'ai-engin':19B 'allow':105C 'arbitrari':9A,115C 'attach':100C 'attack':48B 'belong':42B,90C 'block':65B,130C 'cannot':123C 'check':36B,79C 'content':121C 'convert':56B,96C 'cve':13A,16A 'delet':8A,59B,103C,114C,125C 'editor':5A,51B,109C 'engin':2A,21B,29B,72C 'fail':34B 'global':68B,133C 'higher':54B 'includ':62B,120C 'item':41B,82C 'media':39B,88C 'menus':64B,129C 'navig':63B,128C 'one':85C 'otherwis':124C 'packag':22B 'pass':83C 'perman':7A,58B,102C 'plugin':4A,26B,31B,74C 'post':10A,61B,116C 'request':45B,93C 'role':52B,110C 'style':69B,134C 'templat':12A,66B,131C 'type':119C 'user':46B,94C,106C 'wordpress':3A,23B,25B,30B,73C 'wordpress-plugin':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running AI Engine before `3.7.9` where users hold the Editor role or higher. Exposure depends on those users being able to reach the plugin's media actions; sites with no Editor-level accounts face little risk. Sites that have already updated are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T07:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110976","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110976","severity":null,"published_at":"2026-10-18T07:16:52+00:00","modified_at":"2026-10-19T21:04:50+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}