What is the CVSS score of CVE-2026-16953?

CVE-2026-16953 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-16953?

Yes, a public proof-of-concept exploit is available for CVE-2026-16953. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-16953?

Yes, a patch is available for CVE-2026-16953. Update the affected software to the latest version immediately.

AI Engine CVE-2026-16953

EUVD-2026-54744 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-08 WPScan

GHSA-rv7j-gq5m-787c

WordPress Authentication Bypass Ai Engine Unknown

4.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

4.8 MEDIUM

Network-reachable but AC:H because attacker must separately obtain session cookie and file reference; no confidentiality impact since files are deleted, not read.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:20 vuln.today

CVSS changed

Aug 11, 2026 - 20:22 NVD

4.8 (MEDIUM)

Patch available

Aug 08, 2026 - 07:01 EUVD

CVE Published

Aug 08, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 08, 2026 - 06:00 cve.org

MEDIUM 4.8

DescriptionCVE.org

The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.

AnalysisAI

Unauthorized file deletion in AI Engine WordPress plugin (before 3.6.4) allows a network attacker who has obtained a guest user's session cookie and file reference to delete that guest's uploaded chatbot files without any server-side ownership check. The plugin authorizes deletion actions solely on a client-supplied session value, making it vulnerable to CWE-639 (Authorization Bypass Through User-Controlled Key). A publicly available proof-of-concept exists per WPScan, though EPSS at 0.14% (3rd percentile) indicates exploitation has not yet been observed at scale.

Technical ContextAI

AI Engine is a WordPress plugin (CPE: cpe:2.3:a:unknown:ai_engine:*:*:*:*:*:*:*:*) that enables chatbot functionality, including allowing guest users to upload files during chat sessions. The root cause is CWE-639: Authorization Bypass Through User-Controlled Key - the server resolves authorization by trusting an attacker-controllable value (the session cookie) without verifying that the authenticated session identity actually owns the file targeted for deletion. This is a classic IDOR (Insecure Direct Object Reference) pattern: the file reference and session token together act as a capability token, but neither the file reference nor the session is tied to an ownership record validated server-side. Versions prior to 3.6.4 are confirmed affected.

RemediationAI

Update the AI Engine WordPress plugin to version 3.6.4 or later, which introduces server-side ownership verification for file deletion actions. The vendor advisory and patch details are referenced at https://wpscan.com/vulnerability/8f5460a7-9764-4ce1-9cb4-8202b192765d/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-16953. If immediate patching is not feasible, the most effective compensating control is to disable the guest file upload feature in the AI Engine plugin settings - this eliminates the attack surface entirely, though it will remove that chatbot capability for guests. Implementing session hardening (short-lived sessions, HTTPS enforcement, SameSite cookie flags) raises the bar for session interception but does not eliminate the underlying authorization flaw.