AI Engine EUVD-2026-54745

Subscriber-level exploitation (CVSS PR:L path) requires the AI Engine plugin's public API feature to be explicitly enabled, which is a non-default configuration - without it, this attack path is unavailable to subscriber accounts. The administrator-level path (CVSS PR:H equivalent) requires no special configuration beyond having a WordPress administrator account and the AI Engine plugin installed and active. On multisite WordPress, the administrator path is particularly impactful because non-super subsite administrators - who normally cannot access network-level settings - can read the shared network configuration and its embedded secrets. Limiting factors: no unauthenticated attack path exists under any configuration (PR is at minimum L); without the public API enabled, only administrators can trigger the issue; the exfiltration destination is an external AI service configured within the plugin, meaning an attacker must be able to retrieve data from that external endpoint.

The official CVSS 3.1 score of 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) is arguably conservative on confidentiality: the C:L rating understates the practical impact of arbitrary file read, which can expose wp-config.php and its embedded database credentials, secret salts, and API keys - data of high sensitivity. EPSS at 0.16% (5th percentile) reflects low automated exploitation probability, and there is no CISA KEV listing to confirm active widespread exploitation. However, a publicly available exploit exists (tagged by WPScan), which is an independent risk accelerator that the EPSS signal has not yet fully priced in. The most significant limiting factor is the non-default public API setting required for the subscriber-level attack path; without it, exploitation requires administrator credentials. On standard single-site WordPress this limits the administrator path to already-privileged actors, but on multisite the vulnerability enables a genuine privilege escalation - subsite administrators gaining access to network-scoped secrets they are not supposed to reach. Overall: patch priority is elevated for multisite WordPress operators and any site with the public API feature enabled; lower urgency for standard single-site installations without public API enabled.

An attacker registers or compromises a subscriber-level account on a WordPress site running AI Engine with the public API feature enabled, then sends a crafted API request supplying a path traversal string targeting wp-config.php (e.g., '../../wp-config.php'). The plugin reads the file without validation and forwards its contents - including database host, credentials, and secret keys - to an external AI service endpoint, from which the attacker retrieves the exfiltrated data. A publicly available proof-of-concept demonstrating this technique has been published by WPScan.