---
id: "CVE-2026-110976"
kind: "vulnerability"
aliases: ["CVE-2026-110976"]
title: "AI Engine WordPress plugin: editors can permanently delete arbitrary posts and templates"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ai-engine", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-editor-role-users", "version-3.7.9-or-later"]
published_at: "2026-10-18T07:16:52+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:32:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110976", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# AI Engine WordPress plugin: editors can permanently delete arbitrary posts and templates

The AI Engine WordPress plugin before 3.7.9 fails to check that a media action item belongs to the requesting user. An attacker with the Editor role or higher can convert and permanently delete any post, including navigation menus, block templates and global styles.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed AI Engine version in the WordPress plugins screen or with `wp plugin get ai-engine --field=version`
- Confirm whether the plugin is active on the site

## Fix

- Update AI Engine to `3.7.9` or later
- Review Editor and higher accounts if the site has untrusted users with those roles

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110976

## From the sources

The AI Engine  WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_