CVE-2026-110976
Received Received - Intake

WordPress AI Engine Plugin Unauthorized Post Deletion Vulnerability

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: WPScan

Description
The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-110976
EUVD
EUVD-2026-103398

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown AI Engine 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the AI Engine WordPress plugin before version 3.7.9 allows users with the Editor role or higher to delete arbitrary posts, including restricted content like navigation menus, block templates, and global styles. The issue occurs because the plugin does not verify if the media item being processed belongs to the requesting user before converting it to an attachment and permanently deleting it.

Detection Guidance

Check the installed version of the AI Engine WordPress plugin. If it is below 3.7.9, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to delete important WordPress content, including system files and settings, leading to loss of data, broken functionality, or complete site disruption. Users with Editor roles or higher could remove critical elements like navigation menus or templates.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized deletion of sensitive data or system configurations. Loss of data integrity or availability may violate regulatory requirements for data protection and access controls.

Mitigation Strategies

Update the AI Engine WordPress plugin to version 3.7.9 or later to address the vulnerability. Restrict user roles to the minimum required permissions, especially for Editor roles and above.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110976. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart