Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:ai_engine:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Ai Engine (f2c444f5-d558-5850-ba45-0dc9003d0aa1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-111041 |
vulnerable | 2026-11-03 10:16:11.023903 |
AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media
The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.
Published: 2026-10-18T06:00:16.875Z
Updated: 2026-10-18T11:12:29.843Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110982 |
vulnerable | 2026-11-03 10:16:01.616747 |
AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerpt
The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as navigation menus, block templates, global styles and WooCommerce coupons.
Published: 2026-10-21T06:00:22.070Z
Updated: 2026-10-21T10:35:04.051Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110976 |
vulnerable | 2026-11-03 10:16:00.963479 |
AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media
The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.
Published: 2026-10-18T06:00:16.527Z
Updated: 2026-10-18T11:12:30.129Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16954 |
vulnerable | 2026-09-16 04:32:57.083132 |
AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens
The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.
Published: 2026-08-06T06:00:10.802Z
Updated: 2026-08-06T14:27:40.015Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16955 |
vulnerable | 2026-09-16 04:32:56.952337 |
AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription
The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.
Published: 2026-08-08T06:00:13.729Z
Updated: 2026-08-11T19:40:52.619Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16953 |
vulnerable | 2026-09-16 04:32:56.618330 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12511 |
vulnerable | 2026-07-29 00:23:32.393540 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12510 |
vulnerable | 2026-07-29 00:23:32.393197 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6723 |
vulnerable | 2026-06-08 06:58:20.253139 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6451 |
vulnerable | 2026-06-08 06:58:19.492821 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10499 |
vulnerable | 2026-06-08 06:23:46.790454 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.