CVE-2025-8084

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin is vulnerable to Insecure Direct Object Reference in all versions up to and including 3.7.7 via the 'mediaId' parameter due to missing validation on a user-controlled key. An authenticated attacker with subscriber-level access or above can access and retrieve transcribed contents of private audio attachments belonging to other users, including Administrators. The vulnerability requires the Public API module to be enabled.

The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.

The AI Engine WordPress plugin before version 3.6.4 does not verify ownership of a guest's uploaded files before deletion, relying solely on a client-supplied session cookie value for authorization. An unauthenticated attacker who obtains a victim's session identifier and file reference can delete the victim's uploaded files.

The AI Engine WordPress plugin before version 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.

The AI Engine WordPress plugin before version 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.