EUVD-2026-78296
GHSA-pvv6-3x6h-w6v5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible REST API requires subscriber credentials (PR:L) and non-default Public API configuration; impact is read-only confidentiality of transcribed text with no integrity or availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The AI Engine - The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to access and retrieve the transcribed contents of private audio attachments belonging to other users, including Administrators, via a supplied attachment ID. This vulnerability requires the Public API module to be enabled in the plugin settings; when disabled, the REST route is absent and the endpoint returns HTTP 404.
AnalysisAI
Insecure Direct Object Reference in the AI Engine WordPress plugin (tigroumeow, versions ≤3.7.7) allows authenticated subscribers to retrieve transcribed text from private audio attachments owned by any WordPress user, including site administrators. The mediaId REST API parameter accepts user-supplied attachment IDs without verifying the requester's ownership or access rights, enabling systematic enumeration of sequential WordPress attachment IDs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) a valid WordPress account with at minimum subscriber-level role - unauthenticated access is not possible; (2) the AI Engine plugin's 'Public API' module must be explicitly enabled in plugin settings - when disabled, the REST route does not exist and requests return HTTP 404, completely blocking exploitation; (3) target users must have uploaded audio attachments for which the plugin has generated transcriptions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD/Wordfence CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is largely accurate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the AI Engine plugin to a version beyond 3.7.7; the fix has been committed to the WordPress Plugin SVN repository in changeset 3693379 (https://plugins.trac.wordpress.org/changeset/3693379) - verify the current latest published version in the WordPress Plugin Repository and apply it via the WordPress admin dashboard. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Share
External POC / Exploit Code
Leaving vuln.today