Live › vulnerability › CVE-2026-111041
Go to dashboardThe AI Engine WordPress plugin before 3.7.9 skips an ownership check on certain AI media management actions. An authenticated user with the Editor role or higher can change or change the type of arbitrary posts on the site, including ones they are not allowed to edit.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the AI Engine WordPress plugin before 3.7.9 that have users with the Editor role or above. The sources do not say whether the flaw depends on a particular AI Engine feature being enabled, so the exposure of sites without it enabled is unknown.
No product ranges from the sources yet.
wp plugin get ai-engine --field=version3.7.9 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.
This page as .md · .json · in your agent: get_signal("CVE-2026-111041")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.