CVE-2026-16953

The CVE concerns the AI Engine WordPress plugin (before 3.6.4). The issue is that the plugin does not verify ownership of a guest’s uploaded chatbot files before deletion, authorising a delete action solely via a client-supplied session cookie. An unauthenticated attacker who obtains a victim’s s...