File Reading Vulnerability in AI Engine Plugin for WordPress
CVE-2026-75797
Key Information:
Badges
What is CVE-2026-75797?
The AI Engine plugin for WordPress, prior to version 3.7.2, has a vulnerability that allows users with subscriber-level accounts to access arbitrary files on the server. This occurs when a caller-supplied URL is improperly handled and mapped to a local filesystem path. If a public API feature is enabled, this gives users an opportunity to exfiltrate sensitive data from the server. In a multisite setup, the issue can also be exploited by non-super administrators, enabling them to access network-shared configuration and secrets, posing a significant security risk.
Affected Version(s)
AI Engine 3.3.3 < 3.7.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.