CVE-2023-51409

CVE-2023-51409 AI Engine: ChatGPT Chatbot = 1.9.98 - Caricamento Arbitrario di File non Autenticato tramite restupload Descrizione: Il plugin AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! per WordPress è vulnerabile a caricamenti arbitrari di file a causa della mancanza di...

CVE-2025-11749

CVE-2025-11749 AI Engine = 3.1.3 - Esposizione di informazioni sensibili non autenticata verso escalation dei privilegi ⚠️ AI Engine = 3.1.3 — Esposizione di informazioni sensibili non autenticata → Escalation dei privilegi GitHub: Nxploited Telegram: @KNxploited AVVISO IMPORTANTE: Molte persone...

0-click-RCE-Exploit-for-CVE-2023-51409

CVE-2023-51409 / Exploit RCE 0-Click Autore: Joshua Provoste https://x.com/JoshuaProvoste/status/1858586463777989073 Questo repository contiene un exploit proof-of-concept per CVE-2023-51409, una vulnerabilità di caricamento file arbitrario non autenticato nel plugin WordPress AI Engine: ChatGPT...

CVE-2025-7847-POC

CVE-2025-7847 Wordpress-Plugin – POC für beliebigen Datei-Upload durch authentifizierte Abonnenten Wordpress-Plugin AI Engine 2.9.3 – 2.9.4 Proof of Concept Bitte beachten Sie, dass diese Schwachstelle nur dann ausgenutzt werden kann, wenn die Option „Public API“ aktiviert ist standardmäßig...

WordPress AI Engine plugin < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription vulnerability

Subscriber+ Arbitrary File Read via Audio Transcription vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin AI Engine versions 3.6.6...

WordPress AI Engine plugin < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens vulnerability

Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin AI Engine versions 3.6.4...

WordPress AI Engine plugin < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie vulnerability

Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin AI Engine versions 3.6.4...

Jordy Meow AI Engine - Unrestricted File Upload

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine- ChatGPT Chatbot.This issue affects AI Engine- ChatGPT Chatbot- from n/a through 1.9.98. id: CVE-2023-51409 info: name: Jordy Meow AI Engine - Unrestricted File Upload author: pussycat0x severity: critical...

WordPress AI Engine Plugin - Token Exposure

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...

CVE-2026-75798

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's...

CVE-2026-75797

The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and...

CVE-2026-75798 AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's...

CVE-2026-75798

CVE-2026-75798 affects the AI Engine WordPress plugin in versions 3.4.0 through 3.7.1 . The vulnerability is a missing authorisation check in the Editor Assistant feature, which is intended to be administration-only. Instead of verifying the user's role, the plugin relies on a token it distribute...

EUVD-2026-66282

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's...

EUVD-2026-66281

The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and...

CVE-2026-75797

CVE-2026-75797 is an arbitrary file read vulnerability in the AI Engine WordPress plugin (versions 3.3.3–3.7.1 ). The plugin fails to confine a caller-supplied url parameter when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, enab...

CVE-2026-75797 AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter

The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and...

CVE-2025-13380

AI Engine for WordPress: ChatGPT, GPT Content Generator = 1.0.1 - Lettura Arbitraria di File per utenti autenticati Contributor+ Il plugin AI Engine for WordPress contiene una vulnerabilità nella funzionalità di inserimento immagini che consente a qualsiasi utente autenticato con capacità di...

CVE-2026-75796

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network,...

CVE-2026-75796 AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network,...