# AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini <= 3.9.1 - Unauthenticated Stored Cross-Site Scripting via File Upload

- **ID:** WPSEC-2026-2716
- **Plugin:** AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini (`ai-engine`), https://wordpress.org/plugins/ai-engine/
- **Affected versions:** all versions before 3.9.2
- **Fixed in:** 3.9.2 (Update to 3.9.2 or later.)
- **Severity:** Medium 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ai-engine
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2716/

## Description

The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads (the chatbot and AI Forms upload endpoint /mwai-ui/v1/files/upload and the Public API simpleFileUpload endpoint) in all versions up to, and including, 3.9.1, due to insufficient validation of the uploaded file's content. The upload endpoint accepted any file with an audio extension (such as .flac) even when WordPress's content check had rejected it, and the shared upload routine checked only the filename's extension before copying the file into the public uploads folder. This makes it possible for unauthenticated attackers, on any page that shows a chatbot or form, and authenticated users through the Public API, to upload HTML files disguised as audio that run arbitrary scripts when a user opens the file's URL. Exploitation requires a web server that sends no media type for the extension used, so that the browser renders the file as HTML.

## References

- https://wpsec.com/vuln/WPSEC-2026-2716/
- https://plugins.svn.wordpress.org/ai-engine/tags/3.9.2/
- https://wordpress.org/plugins/ai-engine/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2716/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.