Vulnerabilities / AI Engine
AI Engine vulnerabilities
Advisories WPSec published for AI Engine – The Chatbot, AI Framework & MCP for WordPress. Other sources may list more. Its attack surface: AI Engine on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-18 | WPSEC-2026-1207 | AI Engine <= 3.8.5 - Authenticated (Editor+) Insecure Direct Object Reference to Arbitrary Post Title and Excerpt Modification | Low 2.7 | 3.8.6 |
| 2026-10-15 | WPSEC-2026-1043 | AI Engine <= 3.8.4 - Unauthenticated Insecure Direct Object Reference to File Deletion via File Upload Metadata | Medium 4.8 | 3.8.5 |
| 2026-10-10 | WPSEC-2026-0699 | AI Engine <= 3.8.3 - Authenticated (Contributor+) Missing Authorization to Chatbot Configuration Override via 'mwai_chatbot' Shortcode | Medium 5.4 | 3.8.4 |
| 2026-10-10 | WPSEC-2026-0698 | AI Engine <= 3.8.3 - Missing Authorization to Unauthenticated AI Search and Limited Information Exposure via 'search' REST Endpoint | Medium 6.5 | 3.8.4 |
License: CC BY 4.0