Ai Engine
Monthly
Path traversal in the AI Engine WordPress plugin (versions 3.3.3 through 3.7.1) allows arbitrary server file reads with subsequent exfiltration to an external service. When the plugin's non-default public API feature is enabled, subscriber-level users can supply a crafted URL that the plugin maps to a local filesystem path without confinement, reads, and forwards to an external AI endpoint. In default configurations the flaw is limited to administrator-level users, but on WordPress multisite networks this allows unprivileged subsite administrators to extract network-wide configuration secrets. A publicly available POC exists, though EPSS at 0.19% indicates no widespread automated exploitation at time of analysis.
Privilege escalation in the AI Engine WordPress plugin (versions 2.8.0 through 3.6.0) enables any sub-site Administrator in a WordPress Multisite network to take over arbitrary accounts-including the Network Administrator-due to missing authorization checks on user management operations. A publicly available proof-of-concept exists per WPScan, and a vendor patch has been released at version 3.6.1. No active exploitation is confirmed by CISA KEV at time of analysis, though POC availability substantially lowers the bar for abuse by any authenticated sub-site admin.
Cross-site scripting in the AI Engine WordPress plugin (versions up to and including 3.6.8) allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session when the victim interacts with a crafted payload. The CVSS scope change (S:C) confirms execution occurs outside the plugin's security context, enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code has been confirmed and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Arbitrary file write in the AI Engine WordPress plugin before 3.5.5 lets authenticated editor-level users abuse an unsanitized, user-supplied filename during a file-download-and-save operation to plant attacker-controlled bytes anywhere the web server user can write via path traversal. Because writing a PHP payload into the webroot typically yields remote code execution, this crosses from a content-management flaw into full site compromise. Publicly available exploit code exists and a vendor patch has shipped, though the issue is not listed in CISA KEV.
Privilege escalation in the AI Engine WordPress plugin (Meow Apps) through version 3.4.9 allows authenticated users with Editor-level access to elevate their privileges to Administrator. CVSS rates this 7.2 (High) given high privileges required but full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not present in CISA KEV.
Unauthenticated remote attackers can invoke AI queries against a site owner's configured provider account through the AI Engine WordPress plugin before version 3.7.2. The plugin exposes an administration-only feature protected solely by a token it distributes to anonymous visitors - rather than a proper WordPress capability check - enabling any network-accessible attacker to submit arbitrary AI prompts billed to the operator's account. A publicly available proof-of-concept exists via WPScan; however, the vulnerability is not currently listed in the CISA KEV catalog, and EPSS sits at 0.17% (6th percentile), suggesting limited confirmed mass exploitation at time of analysis.
Path traversal in the AI Engine WordPress plugin before 3.6.6 allows server-side file contents to be read and exfiltrated to an external AI service without path sanitization. When the plugin's public API feature is enabled (a non-default setting), subscriber-level users can trigger this; otherwise the same flaw is accessible to WordPress administrators - and on multisite installations, a non-super subsite administrator can exploit it to read network-wide configuration files and extract embedded secrets such as database credentials and API keys. A publicly available proof-of-concept exists per WPScan; EPSS sits at 0.16% (5th percentile), indicating limited opportunistic scanning activity to date but no confirmed mass exploitation.
Unauthorized file deletion in AI Engine WordPress plugin (before 3.6.4) allows a network attacker who has obtained a guest user's session cookie and file reference to delete that guest's uploaded chatbot files without any server-side ownership check. The plugin authorizes deletion actions solely on a client-supplied session value, making it vulnerable to CWE-639 (Authorization Bypass Through User-Controlled Key). A publicly available proof-of-concept exists per WPScan, though EPSS at 0.14% (3rd percentile) indicates exploitation has not yet been observed at scale.
Cleartext exposure of third-party API keys and authentication tokens in AI Engine WordPress plugin (before 3.6.4) allows Editor-role users to read secrets that are intended to be administrator-only. The plugin inlines sensitive configuration values into admin page JavaScript without redaction, making them readable to any authenticated user with Editor access who inspects the page source. A public proof-of-concept exists per WPScan, though EPSS remains low at 0.17% (7th percentile) and the vulnerability is not in the CISA KEV catalog.
Unauthorized access to private chatbot conversations in the AI Engine WordPress plugin before 3.5.5 allows any authenticated subscriber-level user to both read and overwrite other users' chat records when the discussions feature is enabled. The plugin fails to verify that a client-supplied conversation identifier belongs to the requesting user (CWE-639 IDOR), enabling session data theft and record hijacking. Public exploit code is available via WPScan, though EPSS stands at only 0.13% (3rd percentile), suggesting no widespread automated exploitation; active exploitation is not confirmed in the CISA KEV at time of analysis.
The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to intercept the authorization code and obtain an access token by redirecting the user to an attacker-controlled URI. Note: OAuth is disabled, the 'Meow_MWAI_Labs_OAuth' class is not loaded in the plugin in the patched version 2.8.5.
The AI Engine WordPress plugin (versions 2.8.0-2.8.3) contains a missing capability check in the 'Meow_MWAI_Labs_MCP::can_access_mcp' function, allowing authenticated subscribers and above to access the Model Context Protocol (MCP) interface and execute arbitrary WordPress administrative commands. This enables privilege escalation, unauthorized user creation/modification, and data destruction through post and comment manipulation. The vulnerability has a CVSS score of 8.8 (High) and poses immediate risk to any WordPress installation running affected versions with user registration enabled.
The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when viewing. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.4.7. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.2.63. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unrestricted file upload in Jordy Meow's AI Engine: ChatGPT Chatbot plugin for WordPress (versions up to and including 1.9.98) allows remote attackers to upload arbitrary files of dangerous types, including executable PHP scripts, leading to remote code execution on the underlying web server. With a maximum CVSS score of 10.0, an EPSS score of 92.78% (100th percentile), and publicly available exploit code, this represents an extreme-priority issue for any WordPress site running the plugin.
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.1.4. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.1.4. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Path traversal in the AI Engine WordPress plugin (versions 3.3.3 through 3.7.1) allows arbitrary server file reads with subsequent exfiltration to an external service. When the plugin's non-default public API feature is enabled, subscriber-level users can supply a crafted URL that the plugin maps to a local filesystem path without confinement, reads, and forwards to an external AI endpoint. In default configurations the flaw is limited to administrator-level users, but on WordPress multisite networks this allows unprivileged subsite administrators to extract network-wide configuration secrets. A publicly available POC exists, though EPSS at 0.19% indicates no widespread automated exploitation at time of analysis.
Privilege escalation in the AI Engine WordPress plugin (versions 2.8.0 through 3.6.0) enables any sub-site Administrator in a WordPress Multisite network to take over arbitrary accounts-including the Network Administrator-due to missing authorization checks on user management operations. A publicly available proof-of-concept exists per WPScan, and a vendor patch has been released at version 3.6.1. No active exploitation is confirmed by CISA KEV at time of analysis, though POC availability substantially lowers the bar for abuse by any authenticated sub-site admin.
Cross-site scripting in the AI Engine WordPress plugin (versions up to and including 3.6.8) allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session when the victim interacts with a crafted payload. The CVSS scope change (S:C) confirms execution occurs outside the plugin's security context, enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code has been confirmed and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Arbitrary file write in the AI Engine WordPress plugin before 3.5.5 lets authenticated editor-level users abuse an unsanitized, user-supplied filename during a file-download-and-save operation to plant attacker-controlled bytes anywhere the web server user can write via path traversal. Because writing a PHP payload into the webroot typically yields remote code execution, this crosses from a content-management flaw into full site compromise. Publicly available exploit code exists and a vendor patch has shipped, though the issue is not listed in CISA KEV.
Privilege escalation in the AI Engine WordPress plugin (Meow Apps) through version 3.4.9 allows authenticated users with Editor-level access to elevate their privileges to Administrator. CVSS rates this 7.2 (High) given high privileges required but full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not present in CISA KEV.
Unauthenticated remote attackers can invoke AI queries against a site owner's configured provider account through the AI Engine WordPress plugin before version 3.7.2. The plugin exposes an administration-only feature protected solely by a token it distributes to anonymous visitors - rather than a proper WordPress capability check - enabling any network-accessible attacker to submit arbitrary AI prompts billed to the operator's account. A publicly available proof-of-concept exists via WPScan; however, the vulnerability is not currently listed in the CISA KEV catalog, and EPSS sits at 0.17% (6th percentile), suggesting limited confirmed mass exploitation at time of analysis.
Path traversal in the AI Engine WordPress plugin before 3.6.6 allows server-side file contents to be read and exfiltrated to an external AI service without path sanitization. When the plugin's public API feature is enabled (a non-default setting), subscriber-level users can trigger this; otherwise the same flaw is accessible to WordPress administrators - and on multisite installations, a non-super subsite administrator can exploit it to read network-wide configuration files and extract embedded secrets such as database credentials and API keys. A publicly available proof-of-concept exists per WPScan; EPSS sits at 0.16% (5th percentile), indicating limited opportunistic scanning activity to date but no confirmed mass exploitation.
Unauthorized file deletion in AI Engine WordPress plugin (before 3.6.4) allows a network attacker who has obtained a guest user's session cookie and file reference to delete that guest's uploaded chatbot files without any server-side ownership check. The plugin authorizes deletion actions solely on a client-supplied session value, making it vulnerable to CWE-639 (Authorization Bypass Through User-Controlled Key). A publicly available proof-of-concept exists per WPScan, though EPSS at 0.14% (3rd percentile) indicates exploitation has not yet been observed at scale.
Cleartext exposure of third-party API keys and authentication tokens in AI Engine WordPress plugin (before 3.6.4) allows Editor-role users to read secrets that are intended to be administrator-only. The plugin inlines sensitive configuration values into admin page JavaScript without redaction, making them readable to any authenticated user with Editor access who inspects the page source. A public proof-of-concept exists per WPScan, though EPSS remains low at 0.17% (7th percentile) and the vulnerability is not in the CISA KEV catalog.
Unauthorized access to private chatbot conversations in the AI Engine WordPress plugin before 3.5.5 allows any authenticated subscriber-level user to both read and overwrite other users' chat records when the discussions feature is enabled. The plugin fails to verify that a client-supplied conversation identifier belongs to the requesting user (CWE-639 IDOR), enabling session data theft and record hijacking. Public exploit code is available via WPScan, though EPSS stands at only 0.13% (3rd percentile), suggesting no widespread automated exploitation; active exploitation is not confirmed in the CISA KEV at time of analysis.
The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to intercept the authorization code and obtain an access token by redirecting the user to an attacker-controlled URI. Note: OAuth is disabled, the 'Meow_MWAI_Labs_OAuth' class is not loaded in the plugin in the patched version 2.8.5.
The AI Engine WordPress plugin (versions 2.8.0-2.8.3) contains a missing capability check in the 'Meow_MWAI_Labs_MCP::can_access_mcp' function, allowing authenticated subscribers and above to access the Model Context Protocol (MCP) interface and execute arbitrary WordPress administrative commands. This enables privilege escalation, unauthorized user creation/modification, and data destruction through post and comment manipulation. The vulnerability has a CVSS score of 8.8 (High) and poses immediate risk to any WordPress installation running affected versions with user registration enabled.
The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when viewing. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.4.7. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.2.63. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unrestricted file upload in Jordy Meow's AI Engine: ChatGPT Chatbot plugin for WordPress (versions up to and including 1.9.98) allows remote attackers to upload arbitrary files of dangerous types, including executable PHP scripts, leading to remote code execution on the underlying web server. With a maximum CVSS score of 10.0, an EPSS score of 92.78% (100th percentile), and publicly available exploit code, this represents an extreme-priority issue for any WordPress site running the plugin.
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.1.4. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.1.4. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.