Unauthorized Media Action in AI Engine Plugin for WordPress by AI Technology
CVE-2026-110976
Key Information:
Badges
What is CVE-2026-110976?
The AI Engine WordPress plugin prior to version 3.7.9 is susceptible to an improper access control vulnerability. This allows users with elevated roles, such as Editor or higher, to exploit the media action functionalities. The flaw permits these users to delete any post type indiscriminately, including navigation menus, block templates, and global styles, which they would normally lack permission to delete. This vulnerability poses significant risks to content integrity within WordPress sites utilizing this plugin, as it enables unauthorized modifications that can disrupt the site's structure and functionality.
Affected Version(s)
AI Engine 0 < 3.7.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.