AI Engine CVE-2026-16953

Exploitation requires two concrete prerequisites: (1) the attacker must obtain a valid guest session cookie for a victim who has an active chatbot session with the AI Engine plugin - this is the primary barrier and what drives AC:H; and (2) the attacker must know or enumerate the target victim's uploaded file reference. The guest file upload feature of the AI Engine chatbot must be in use (i.e., the site must allow guests to upload files to the chatbot). No WordPress account or authentication is required by the attacker (PR:N confirmed by CVSS vector). Exploitation is limited to deleting files belonging to other guest users - it does not enable reading those files, elevating privileges, or affecting authenticated WordPress user content. Sites enforcing HTTPS with properly scoped session cookies significantly reduce the practicality of session interception.

The NVD CVSS 3.1 score of 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L accurately reflects the constrained real-world risk. AC:H is appropriate because successful exploitation requires two preconditions: obtaining a victim guest's session cookie AND knowing the target file reference - neither of which is trivially available to a passive network attacker. EPSS at 0.14% (3rd percentile) corroborates low observed exploitation probability despite POC availability. There is no KEV listing, meaning CISA has not confirmed active in-the-wild exploitation. The impact is bounded: no confidentiality loss, no privilege escalation, and damage is limited to deletion of a specific guest's uploaded files (I:L, A:L). This is not a high-priority emergency patch absent a targeted attack scenario, but the publicly available POC raises the risk for sites where session interception is feasible (e.g., sites without HTTPS or susceptible to XSS). The combination of low EPSS and POC-but-no-KEV is consistent with a targeted rather than mass-exploitation pattern.

An attacker intercepts or otherwise obtains a guest user's session cookie from a WordPress site running AI Engine (e.g., via a network-level sniff on an HTTP-only site or through XSS on a co-hosted plugin). Armed with the session value and knowledge of the victim's uploaded file identifier, the attacker crafts a deletion request containing the stolen cookie, which the plugin accepts and executes without verifying that the session owner matches the file owner. A publicly available proof-of-concept documented by WPScan demonstrates this flow.