CVE-2026-1400
Arbitrary File Upload in AI Engine Plugin Enables RCE
Publication date: 2026-01-28
Last updated on: 2026-01-28
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ai_engine | the_chatbot_and_ai_framework_for_wordpress | to 3.3.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the AI Engine – The Chatbot and AI Framework for WordPress plugin, where a missing file type validation in the rest_helpers_update_media_metadata function allows authenticated users with Editor-level access or higher to upload arbitrary files. An attacker can upload a benign image file and then rename it to a PHP file using the update_media_metadata endpoint, resulting in an executable PHP file on the server.
How can this vulnerability impact me? :
The vulnerability can allow an attacker with sufficient privileges to upload and execute arbitrary PHP code on the affected WordPress site, potentially leading to remote code execution. This can compromise the server, allowing the attacker to take control, steal data, or disrupt services.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the AI Engine – The Chatbot and AI Framework for WordPress plugin to a version later than 3.3.2 where the issue is fixed. Additionally, restrict Editor-level access and above to trusted users only, and monitor the uploads directory for suspicious PHP files that may have been uploaded and renamed. Consider disabling or restricting the use of the `update_media_metadata` REST endpoint if possible until the plugin is updated.