---
id: "CVE-2026-111041"
kind: "vulnerability"
aliases: ["CVE-2026-111041"]
title: "AI Engine WordPress plugin lets Editors modify posts they should not edit"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wordpress", "wordpress-plugins"]
not_affected_if: ["plugin-version-3.7.9-or-later"]
published_at: "2026-10-18T07:16:52+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:32:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111041", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# AI Engine WordPress plugin lets Editors modify posts they should not edit

The AI Engine WordPress plugin before 3.7.9 skips an ownership check on certain AI media management actions. An authenticated user with the Editor role or higher can change or change the type of arbitrary posts on the site, including ones they are not allowed to edit.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed AI Engine version in the WordPress plugins screen or with `wp plugin get ai-engine --field=version`
- unknown

## Fix

- Update the AI Engine plugin to `3.7.9` or later
- unknown

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111041

## From the sources

The AI Engine  WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_