CVE-2026-107745
Received Received - Intake

Media File Deletion in AI Engine WordPress Plugin

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: Wordfence

Description
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-107745
EUVD
EUVD-2026-111565

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the AI Engine WordPress plugin. It allows authenticated attackers with subscriber-level access or higher to delete arbitrary media files on the server due to insufficient file path validation in the upload_file function. Exploitation requires the administrator to have enabled the Public API option and depends on the hourly cleanup_files task running after a malicious upload.

Detection Guidance

Check WordPress media files for unauthorized deletions or modifications. Review server logs for suspicious upload_file function calls. Look for files deleted during the hourly cleanup_files task if Public API was enabled.

Impact Analysis

An attacker could delete important media files from your WordPress site, potentially causing data loss, disrupting site functionality, or leading to unauthorized content removal. This could affect site operations, user experience, and data integrity.

Compliance Impact

This vulnerability could lead to unauthorized data deletion, which may violate compliance requirements for data integrity and availability under regulations like GDPR or HIPAA. Loss of media files could result in non-compliance if those files contained protected or sensitive data.

Mitigation Strategies

Update the AI Engine plugin to the latest version beyond 3.8.4. Disable the Public API option if not required. Monitor media files for unauthorized changes and restrict subscriber-level access to sensitive functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107745. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart