CVE-2026-111041
Received Received - Intake

AI Media Management Privilege Escalation in WordPress Plugin

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: WPScan

Description
The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-111041
EUVD
EUVD-2026-103400

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown AI Engine 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the AI Engine WordPress plugin before version 3.7.9 allows users with the Editor role or higher to modify or change the type of arbitrary posts without proper ownership verification. This occurs due to missing authorization checks in specific functions.

Detection Guidance

Check the installed version of the AI Engine WordPress plugin. If it is below 3.7.9, the vulnerability is present. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details.

Impact Analysis

An attacker with Editor privileges could edit or delete posts they are not authorized to access, potentially altering website content, removing important information, or changing post types without permission.

Compliance Impact

This vulnerability could lead to unauthorized modifications of sensitive data, violating integrity and access control requirements in GDPR and HIPAA. It may result in non-compliance due to improper data handling and unauthorized access.

Mitigation Strategies

Update the AI Engine plugin to version 3.7.9 or later immediately. Remove or restrict access for users with the Editor role or higher until the update is applied. Monitor for unauthorized post modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111041. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart