AI Engine EUVD-2026-66281

Subscriber-level exploitation requires the AI Engine plugin's 'public API' feature to be explicitly enabled by a site administrator - this is a non-default configuration, so most single-site WordPress installations are not exposed to low-privilege attacks. In default configurations, the same path traversal is reachable only by users with administrator-level privileges. On WordPress multisite networks, the administrator-level vector is additionally impactful: a subsite administrator (lacking super-admin rights) can read network-shared configuration files and extract secrets such as API keys or database credentials that are shared across the entire network. What limits exploitation: subscriber-level attack requires an administrator to have deliberately enabled the public API option; default single-site installations expose only the admin vector; the SSVC rating of automatable 'no' suggests the targeting conditions make mass scanning less effective. What does not limit exploitation once conditions are met: no user interaction, no complex chaining, and low attack complexity once the feature is confirmed active.

CVSS 3.1 scores this at 7.7 (High) with AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, reflecting network-accessible exploitation requiring only subscriber credentials, no user interaction, a scope change across the security boundary, and high confidentiality impact. However, this score represents the worst-case scenario: subscriber-level exploitation requires the non-default public API feature to be explicitly enabled by an administrator. In default deployments, only administrators can trigger the flaw, substantially reducing the exposed attack surface. EPSS at 0.19% (9th percentile) indicates low probability of automated exploitation, and SSVC rates exploitation as 'none' with automatable 'no' and technical impact 'partial' - all signals aligning below the CVSS headline. The publicly available POC lowers technical barrier, but the non-default condition requirement and lack of CISA KEV listing suggest this is not yet being broadly weaponized. The highest realistic risk is to WordPress multisite operators where subsite administrator accounts represent a meaningful privilege escalation surface to network-wide secrets.

An attacker registers or obtains a subscriber-level account on a WordPress site with AI Engine installed and the public API feature enabled, then submits a crafted request with a URL containing path traversal sequences targeting sensitive files such as wp-config.php or server-level credentials. The plugin resolves the path without confinement, reads the file, and automatically forwards its contents to an external AI service endpoint configured by the attacker or accessible to them - completing a full read-and-exfiltrate chain in a single request. A publicly available POC exists that lowers the technical barrier for this attack.