{"id":"CVE-2026-12511","aliases":["EUVD-2026-43626","GHSA-jp8h-m8g9-6fvr"],"status":"published","title":"AI Engine \u003c 3.5.5 - Editor+ Arbitrary File Write via Path Traversal","description":"The AI Engine  WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00468,"percentile":0.40971,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-07-14T06:00:02Z","modified":"2026-07-14T16:42:11Z","products":[{"vendor":"jordy meow","product":"ai engine"},{"vendor":"unknown","product":"ai engine"}],"references":[{"url":"https://wpscan.com/vulnerability/cf3cf59e-da36-429b-8794-5a46587e8462/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12511"},{"url":"https://wpscan.com/vulnerability/cf3cf59e-da36-429b-8794-5a46587e8462"},{"url":"https://github.com/advisories/GHSA-jp8h-m8g9-6fvr"}],"sources":{"cve":[{"id":"CVE-2026-12511","title":"AI Engine \u003c 3.5.5 - Editor+ Arbitrary File Write via Path Traversal","description":"The AI Engine  WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.","status":"published","published":"2026-07-14T06:00:02.489Z","modified":"2026-07-14T12:59:54.068Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:19:48.461833Z"}],"euvd":[{"id":"EUVD-2026-43626","description":"The AI Engine  WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.","status":"published","published":"2026-07-14T06:00:02Z","modified":"2026-07-14T12:59:54Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:00.206712Z"}],"ghsa":[{"id":"GHSA-jp8h-m8g9-6fvr","title":"The AI Engine  WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before...","description":"The AI Engine  WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.","status":"published","published":"2026-07-14T06:31:23Z","modified":"2026-07-14T15:32:15Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:09:27.031Z"}],"nvd":[{"id":"CVE-2026-12511","description":"The AI Engine  WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.","status":"published","published":"2026-07-14T06:17:05.787Z","modified":"2026-07-14T16:42:11.91Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:29.114188Z"}]}}