PT-2026-69183 · WordPress · Ai Engine
CVE-2026-16953
·
Published
2026-08-08
·
Updated
2026-08-11
CVSS v3.1
4.8
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
AI Engine versions prior to 3.6.4
Description
The AI Engine WordPress plugin fails to verify the ownership of chatbot files uploaded by guests during the deletion process. The system authorizes the deletion based only on a session cookie provided by the client. Consequently, an unauthenticated attacker who acquires a victim's session identifier and the specific file reference can delete files uploaded by that victim.
Recommendations
Update AI Engine to version 3.6.4 or later.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ai Engine