CVE-2026-16953
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The AI Engine WordPress plugin before version 3.6.4 does not verify ownership of a guest's uploaded files before deletion, relying solely on a client-supplied session cookie value for authorization. An unauthenticated attacker who obtains a victim's session identifier and file reference can delete the victim's uploaded files.
Risk Assessment
The risk is unauthorized deletion of user files, potentially leading to data loss and service integrity compromise.
Recommendation
Immediately update the AI Engine plugin to version 3.6.4 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.