255 matches found
0-click-RCE-Exploit-for-CVE-2023-51409
CVE-2023-51409 / Exploit RCE 0-Click Autore: Joshua Provoste https://x.com/JoshuaProvoste/status/1858586463777989073 Questo repository contiene un exploit proof-of-concept per CVE-2023-51409, una vulnerabilità di caricamento file arbitrario non autenticato nel plugin WordPress AI Engine: ChatGPT...
CVE-2026-75798
The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's...
CVE-2026-75797
The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and...
CVE-2026-75798 AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant
The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's...
CVE-2026-75798
CVE-2026-75798 affects the AI Engine WordPress plugin in versions 3.4.0 through 3.7.1 . The vulnerability is a missing authorisation check in the Editor Assistant feature, which is intended to be administration-only. Instead of verifying the user's role, the plugin relies on a token it distribute...
EUVD-2026-66282
The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's...
CVE-2026-75797
The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and...
EUVD-2026-66281
The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and...
CVE-2026-75797 AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter
The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and...
CVE-2025-13380
AI Engine for WordPress: ChatGPT, GPT Content Generator = 1.0.1 - Lettura Arbitraria di File per utenti autenticati Contributor+ Il plugin AI Engine for WordPress contiene una vulnerabilità nella funzionalità di inserimento immagini che consente a qualsiasi utente autenticato con capacità di...
Jordy Meow AI Engine - Unrestricted File Upload
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine- ChatGPT Chatbot.This issue affects AI Engine- ChatGPT Chatbot- from n/a through 1.9.98. id: CVE-2023-51409 info: name: Jordy Meow AI Engine - Unrestricted File Upload author: pussycat0x severity: critical...
WordPress AI Engine Plugin - Token Exposure
Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...
CVE-2025-7847-POC
CVE-2025-7847 Plugin WordPress - POC di Caricamento Arbitrario di File da Abbonato Autenticato Plugin WordPress AI Engine 2.9.3 - 2.9.4 - Prova di Concetto Si prega di notare che questa vulnerabilità può essere sfruttata solo se l’opzione “Public API” è abilitata, che è disabilitata per...
CVE-2025-11749
CVE-2025-11749 AI Engine = 3.1.3 - Nicht authentifizierte Preisgabe sensibler Informationen zu Rechteausweitung ⚠️ AI Engine = 3.1.3 — Nicht authentifizierte Preisgabe sensibler Informationen → Rechteausweitung GitHub: Nxploited Telegram: @KNxploited WICHTIGER HINWEIS: Viele unethische Personen...
CVE-2023-51409
CVE-2023-51409 AI Engine: ChatGPT Chatbot = 1.9.98 - Caricamento Arbitrario di File non Autenticato tramite restupload Descrizione: Il plugin AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! per WordPress è vulnerabile a caricamenti arbitrari di file a causa della mancanza di...
CVE-2026-75796
The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network,...
CVE-2026-75796
CVE-2026-75796 affects the AI Engine WordPress plugin (versions 2.8.0 through 3.6.0 ). The vulnerability is a missing authorization check in the plugin's MCP User Tools , which perform privileged user management operations without verifying that the requesting user is authorized to act on the tar...
EUVD-2026-63824
The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network,...
CVE-2026-75796 AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools
The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network,...
CVE-2026-16955
The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at...