Ai Engine Mcp Server Ai Chatbot For Wordpress With Claude Chatgpt Gemini
Monthly
Limited arbitrary media file deletion affects the WordPress plugin AI Engine - MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini in all versions up to and including 3.8.4. An authenticated attacker holding only subscriber-level access can abuse insufficient path validation in the plugin's upload_file function to target media files outside the intended upload location, but three prerequisites must align: the administrator must have explicitly enabled the plugin's non-default Public API option, and the plugin's scheduled hourly cleanup_files task must run after the malicious upload before the deletion takes effect. Wordfence rates this Medium (CVSS 4.2, AC:H) with impact limited to integrity and availability of media files and no confidentiality exposure; no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV.
Limited arbitrary media file deletion affects the WordPress plugin AI Engine - MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini in all versions up to and including 3.8.4. An authenticated attacker holding only subscriber-level access can abuse insufficient path validation in the plugin's upload_file function to target media files outside the intended upload location, but three prerequisites must align: the administrator must have explicitly enabled the plugin's non-default Public API option, and the plugin's scheduled hourly cleanup_files task must run after the malicious upload before the deletion takes effect. Wordfence rates this Medium (CVSS 4.2, AC:H) with impact limited to integrity and availability of media files and no confidentiality exposure; no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV.