Unauthorized File Deletion in AI Engine Plugin for WordPress
CVE-2026-16953
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16953?
The AI Engine WordPress plugin prior to version 3.6.4 suffers from a vulnerability that allows an unauthenticated attacker to delete user-uploaded chatbot files. This security flaw arises due to insufficient verification of the ownership of uploaded files, relying solely on a client-supplied session cookie value. If an attacker manages to obtain a victim's session identifier and the relevant file reference, they can exploit this vulnerability to remove files without proper authorization.
Affected Version(s)
AI Engine 0 < 3.6.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.