AI Engine vulnerabilities
We track 4 vulnerabilities in AI Engine products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 26, 2026.
Latest AI Engine vulnerabilities
- 7.7 High severity
AI Engine: Improper Limitation of a Pathname to a Restricted Directory
The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arb
- 7.2 High severity
AI Engine: Improper Privilege Management
The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to tak
- 7.2 High severity
AI Engine: Improper Neutralization of Special Elements used in an SQL Command
The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacks
- 7.2 High severity
AI Engine: Insertion of Sensitive Information into Log File
AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file extension of "logs_path", allowing Administrators to change log filetypes from .log to .php.