{
 "id": "WPSEC-2026-1805",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1805/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1805/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1805/index.md",
 "title": "AI Engine <= 3.8.7 - Authenticated (Subscriber+) Protected Upload File Disclosure via Public API Vision and Transcription Queries",
 "description": "The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'url' parameter of the Public API simpleVisionQuery and simpleTranscribeAudio REST endpoints in all versions up to, and including, 3.8.7, due to Meow_MWAI_Query_DroppedFile reading any URL on the site's own host under the uploads directory straight from disk, which bypasses web server access rules such as .htaccess protection on upload folders. This makes it possible for authenticated attackers, with Subscriber-level access and above, to have protected uploaded files (for example WooCommerce downloadable product files or form uploads) sent to the configured AI model and to get their contents back in the response. The Public API must be enabled, which it is not by default.",
 "plugin": {
  "slug": "ai-engine",
  "name": "AI Engine",
  "full_name": "AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini",
  "wordpress_org": "https://wordpress.org/plugins/ai-engine/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ai-engine/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ai-engine"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-552"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.8.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.8.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.8.8",
 "remediation": "Update to 3.8.8 or later.",
 "fix_released": "2026-10-27T05:40:40+00:00",
 "published": "2026-10-28T05:46:21+00:00",
 "updated": "2026-10-27T13:38:30.529475+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1805/",
  "https://plugins.svn.wordpress.org/ai-engine/tags/3.8.8/",
  "https://wordpress.org/plugins/ai-engine/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ai-engine",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-28"
 }
}