AI Engine vulnerabilities

3 known vulnerabilities in AI Engine from Tigroumeow. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  AI Engine: Unrestricted Upload of File with Dangerous Type

  CVE-2025-7847Jul 31, 2025TigroumeowEPSS 1.3%

  The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_simpleFileUpload() function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access

• 8.0 High severity

  AI Engine: URL Redirection to Untrusted Site

  CVE-2025-6238Jul 4, 2025Tigroumeow

  The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated

• 8.8 High severity

  AI Engine: Incorrect Authorization

  CVE-2025-5071Jun 19, 2025Tigroumeow

  The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs_MCP::can_access_mcp' function in versions 2.8.0 to 2.8.3. This makes it possible for authenticated a