What the vulnerability does
01Description
The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `rest_helpers_update_media_metadata` function in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The attacker can upload a benign image file, then use the `update_media_metadata` endpoint to rename it to a PHP file, creating an executable PHP file in the uploads directory.
Explanation of Vulnerability in Simple Terms
02Summary
The AI Engine plugin for WordPress contains an unrestricted file upload vulnerability affecting versions up to 3.3.2. An authenticated administrator can upload arbitrary files to the server, potentially including malicious code. This allows an attacker with admin privileges to run their own code on the site and compromise the entire WordPress installation.
What an attacker can do
03Attacker Capabilities
Upload arbitrary files to the server and execute malicious code on the WordPress site.
Potential impact on your site
04Site Impact
A compromised admin account can lead to full site takeover, data theft, and malware installation.
Conditions required to exploit
05Prerequisites
Attacker must have administrator-level access to the WordPress site.
Key dates
06Disclosure timeline
January 28, 2026
CVE published
April 8, 2026
Record updated
