AI Engine – The Chatbot, AI Framework & MCP for WordPress

Güvenlik açıkları

• CVE-2025-11749kimlik doğrulamasız≤ 3.1.3

  AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation

  Kritik 9.8

• CVE-2023-51409kimlik doğrulamasız≤ 1.9.98

  WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability

  Kritik 9.8

• CVE-2026-23802yüksek yetki≤ 3.3.2

  WordPress AI Engine plugin <= 3.3.2 - Arbitrary File Upload vulnerability

  Kritik 9.1

• CVE-2026-15988kimlik doğrulamasız · tıklama gerekir≤ 3.6.5

  AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match

  Yüksek 8.8

• CVE-2026-8719abone+

  AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token

  Yüksek 8.8

• CVE-2025-7847abone+≤ 2.9.4

  AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload

  Yüksek 8.8

• CVE-2025-5071abone+≤ 2.8.3

  AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP

  Yüksek 8.8

• CVE-2025-6238kimlik doğrulamasız · tıklama gerekir

  AI Engine 2.8.4 - Insecure OAuth Implementation

  Yüksek 8.0

• CVE-2026-96561kimlik doğrulamasız≤ 3.8.0

  AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection

  Yüksek 7.2

• CVE-2026-27407editör+≤ 3.4.9

  WordPress AI Engine plugin <= 3.4.9 - Privilege Escalation vulnerability

  Yüksek 7.2

• CVE-2026-1400editör+≤ 3.3.2

  AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint

  Yüksek 7.2

• CVE-2024-34440yüksek yetki≤ 2.2.63

  WordPress AI Engine plugin <= 2.2.63 - Auth. Arbitrary File Upload vulnerability

  Yüksek 7.2

• CVE-2024-29100yüksek yetki≤ 2.1.4

  WordPress AI Engine plugin <= 2.1.4 - Arbitrary File Upload vulnerability

  Yüksek 7.2

• CVE-2024-0699editör+≤ 2.1.4

  AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url

  Yüksek 7.2

• CVE-2026-65545kimlik doğrulamasız · tıklama gerekir≤ 3.6.8

  WordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

  Yüksek 7.1

• CVE-2024-38791giriş gerekir≤ 2.4.7

  WordPress AI ENGINE plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability

  Yüksek 7.1

• CVE-2025-8084editör+≤ 3.1.8

  AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery

  Orta 6.8

• CVE-2024-29090yüksek yetki≤ 2.1.4

  WordPress AI Engine plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability

  Orta 6.8

• CVE-2025-8268kimlik doğrulamasız≤ 2.9.5

  Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion

  Orta 6.5

• CVE-2026-89141abone+≤ 3.7.7

  AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter

  Orta 6.5

• CVE-2025-7780abone+≤ 2.9.4

  AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions

  Orta 6.5

• CVE-2026-0746abone+≤ 3.3.2

  AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery

  Orta 6.4

• CVE-2024-0378kimlik doğrulamasız≤ 2.2.0

  AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting

  Orta 6.1

• CVE-2025-5570abone+≤ 2.8.4

  AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter

  Orta 5.4

• CVE-2026-93623kimlik doğrulamasız≤ 3.7.8

  WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability

  Orta 5.3