WordPress AI Engine plugin <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Sensitive Attachment Disclosure via 'mediaId' Parameter vulnerability discovered by Chi Trung Huynh - Duy Tan Universiy in WordPress Plugin AI Engine versions = 3.7.7...

WordPress AI Engine plugin 3.3.3-3.7.2 - 3.7.1 - Subscriber+ Arbitrary File Read vulnerability

WordPress AI Engine plugin 3.3.3-3.7.2 - 3.7.1 - Subscriber+ Arbitrary File Read vulnerability discovered by Jashid Sany in WordPress Plugin AI Engine versions 3.3.3-3.7.1...

WordPress AI Engine plugin < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription vulnerability

Subscriber+ Arbitrary File Read via Audio Transcription vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin AI Engine versions 3.6.6...

WordPress AI Engine plugin 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools vulnerability

WordPress AI Engine plugin 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools vulnerability discovered by Charles Vosburgh in WordPress Plugin AI Engine versions = 3.6.0...

WordPress AI Engine Cross-Site Script Vulnerability

WordPress AI Engine is an official WordPress plugin developed by developer JordyMeow. It aims to seamlessly integrate mainstream large language models such as OpenAI, Anthropic, and Google into the WordPress backend, providing core features like chatbots, content generation, AI forms, and...

WordPress AI Engine path traversal vulnerability

WordPress AI Engine is a core component of the official WordPress plugin library developed by developer JordyMeow. Its purpose is to integrate multi-model AI capabilities chatbots, content generation, MCP smart agents, etc. natively into the WordPress backend, allowing for easy invocation of...

WordPress AI Engine authorization bypass vulnerability

WordPress AI Engine is a core component of the official WordPress plugin library developed by developer JordyMeow. Its purpose is to integrate multi-model AI capabilities chatbots, content generation, MCP smart agents, etc. directly into the WordPress backend, allowing for easy invocation of...

CVE-2026-65545

CVE-2026-65545 concerns the WordPress plugin AI Engine (versions

CVE-2026-65545 WordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in AI Engine = 3.6.8 versions...

CVE-2026-27407

CVE-2026-27407 concerns the WordPress AI Engine plugin, affected versions

CVE-2026-23802 WordPress AI Engine plugin <= 3.3.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine ai-engine allows Using Malicious Files.This issue affects AI Engine: from n/a through = 3.3.2...

📄 WordPress AI Engine: ChatGPT Chatbot 1.9.98 Shell Upload

This is a proof of concept that demonstrates the CVE-2023-51409 vulnerability in the WordPress AI Engine plugin in a controlled, safe, and non-destructive manner. It detects the plugin, tests unauthenticated access to the vulnerable endpoint, performs safe file uploads with non-executable content...

CVE-2026-0746 AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery

The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the 'getaudio' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations...

📄 WordPress AI Engine 3.1.3 Remote Code Execution

This Metasploit module exploits an unauthenticated vulnerability in the WordPress AI Engine plugin versions less than or equal to 3.1.3. The vulnerability allows an attacker to create an administrator account via the MCP Model Context Protocol endpoint without authentication. The module supports...

CVE-2025-13380

The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1. This is due to insufficient validation of user-supplied file paths in the 'lqdaiupdatepost' AJAX endpoint and the use of filegetconten...

CVE-2025-13380 AI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read

The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1. This is due to insufficient validation of user-supplied file paths in the 'lqdaiupdatepost' AJAX endpoint and the use of filegetconten...

Exploit for CVE-2025-13380

AI Engine for WordPress: ChatGPT, GPT Content Generator true,...

EUVD-2025-197990

The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.8 via the resthelperscreateimages function. This makes it possible for authenticated attackers, with Editor-level access and above, to make web requests to arbitrary locations...

CVE-2025-8084

CVE-2025-8084 affects the WordPress AI Engine plugin. All versions up to and including 3.1.8 are vulnerable to Server-Side Request Forgery via the rest_helpers_create_images function. An authenticated attacker with Editor-level access or higher can cause the web application to issue requests to a...

EUVD-2025-158262

The AI Engine plugin for WordPress is vulnerable to PHP Object Injection via PHAR Deserialization in all versions up to, and including, 3.1.8 via deserialization of untrusted input in the 'restsimpleTranscribeAudio' and 'restsimpleVisionQuery' functions. This makes it possible for authenticated...