Unauthorized Access and Data Loss in AI Engine Plugin for WordPress
CVE-2025-8268
6.5MEDIUM
What is CVE-2025-8268?
The AI Engine plugin for WordPress has a security flaw that allows unauthorized users to access and manipulate other users' uploaded files. This issue arises from a lack of proper capability checks in the rest_list and delete_files functions. As a result, unauthenticated attackers can list and delete files belonging to other users, potentially leading to significant data loss and privacy concerns across affected installations.
Affected Version(s)
AI Engine * <= 2.9.5
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
ISMAILSHADOW