File Path Exposure in AI Engine WordPress Plugin by Developer
CVE-2026-16955
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16955?
The AI Engine WordPress plugin prior to version 3.6.6 lacks proper validation of caller-supplied file paths, allowing individuals with subscriber-level access to read arbitrary files from the server. This vulnerability can lead to unauthorized data exfiltration when a specific public API feature is enabled. Moreover, if the issue is exploited by an administrator on a multisite setup, a non-super subsite administrator may gain access to the network-shared configuration and sensitive secrets.
Affected Version(s)
AI Engine 0 < 3.6.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.