{"id":"CVE-2026-107745","aliases":["EUVD-2026-111565","GHSA-xfc5-7gqh-v42g"],"status":"published","title":"AI Engine \u003c= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter","description":"The AI Engine – The Chatbot, AI Framework \u0026 MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00322,"percentile":0.25492,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-10-28T02:29:59Z","modified":"2026-10-29T02:16:46Z","products":[{"vendor":"tigroumeow","product":"ai engine – mcp server \u0026 ai chatbot for wordpress, with claude, chatgpt \u0026 gemini"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4f8607c-711e-4d0e-8379-49346033a837?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/classes/modules/files.php#L470"},{"url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/classes/modules/files.php#L62"},{"url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/classes/modules/files.php#L1071"},{"url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/classes/api.php#L689"},{"url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/classes/api.php#L1040"},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Fai-engine%2Ftags%2F3.8.4%2Fclasses%2Fmodules%2Ffiles.php\u0026new_path=%2Fai-engine%2Ftags%2F3.8.5%2Fclasses%2Fmodules%2Ffiles.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107745"},{"url":"https://github.com/advisories/GHSA-xfc5-7gqh-v42g"}],"sources":{"cve":[{"id":"CVE-2026-107745","title":"AI Engine \u003c= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter","description":"The AI Engine – The Chatbot, AI Framework \u0026 MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.","status":"published","published":"2026-10-28T02:29:59.766Z","modified":"2026-10-29T01:51:59.196Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:45:25.313702Z"}],"euvd":[{"id":"EUVD-2026-111565","description":"The AI Engine – The Chatbot, AI Framework \u0026 MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.","status":"published","published":"2026-10-28T02:29:59Z","modified":"2026-10-29T01:51:59Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:59:18.489561Z"}],"ghsa":[{"id":"GHSA-xfc5-7gqh-v42g","title":"The AI Engine – The Chatbot, AI Framework \u0026 MCP for WordPress plugin for WordPress is vulnerable...","description":"The AI Engine – The Chatbot, AI Framework \u0026 MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.","status":"published","published":"2026-10-28T03:31:49Z","modified":"2026-10-28T03:31:57Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:14:32.579072Z"}],"nvd":[{"id":"CVE-2026-107745","description":"The AI Engine – The Chatbot, AI Framework \u0026 MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.","status":"published","published":"2026-10-28T03:17:09.037Z","modified":"2026-10-29T02:16:46.427Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:13:04.037468Z"}]}}