Limited Media File Deletion Vulnerability in AI Engine Plugin for WordPress
CVE-2026-107745
4.2MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 28 October 2026
What is CVE-2026-107745?
The AI Engine plugin for WordPress is susceptible to a vulnerability that allows authenticated users, with at least subscriber-level access, to delete arbitrary media files from the server. This occurs due to insufficient validation of file paths within the upload_file function in versions up to 3.8.4. Exploitation can take place if the administrator has enabled the Public API option, compounded by the dependency on the hourly cleanup_files task that runs post malicious uploads. It is crucial for users to promptly update their systems to mitigate this risk.
Affected Version(s)
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini 0 <= 3.8.4