AI Engine – The Chatbot, AI Framework & MCP for WordPress

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   AI Engine – The Chatbot, AI Framework & MCP for WordPress

Information

Software Type Plugin
Software Slug ai-engine (view on wordpress.org)
Software Status Active
Software Author tigroumeow
Software Website wordpress.org
Software Downloads 7,141,012
Software Active Installs 100,000
Software Record Last Updated July 21, 2026

Showing 1-20 of 24 Vulnerabilities

Submit a Vulnerability
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.4.9 - Authenticated (Editor+) Privilege Escalation
7.2
CVE-2026-27407
May 28, 2026
Researcher: Phat RiO
AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token
8.8
CVE-2026-8719
May 16, 2026
Researcher: daroo
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload
7.2
CVE-2026-23802
Feb 25, 2026
Researcher: 0xd4rk5id3
AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint
7.2
CVE-2026-1400
Jan 27, 2026
Researcher: type5afe
AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery
6.4
CVE-2026-0746
Jan 27, 2026
Researcher: type5afe
AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery
6.8
CVE-2025-8084
Nov 18, 2025
Researcher: Jonas Benjamin Friedli
AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization
7.1
CVE-2025-12844
Nov 12, 2025
Researcher: ISMAILSHADOW
AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
9.8
CVE-2025-11749
Nov 4, 2025
Researcher: Emiliano Versini
Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion
6.5
CVE-2025-8268
Sep 3, 2025
Researcher: ISMAILSHADOW
AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVE-2025-7847
Jul 30, 2025
Researcher: ISMAILSHADOW
AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions
6.5
CVE-2025-7780
Jul 23, 2025
Researcher: ISMAILSHADOW
AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter
5.4
CVE-2025-5570
Jul 7, 2025
Researcher: mikemyers
AI Engine 2.8.4 - Insecure OAuth Implementation
8.0
CVE-2025-6238
Jul 3, 2025
Researcher: István Márton
AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP
8.8
CVE-2025-5071
Jun 18, 2025
Researcher: István Márton
AI Engine <= 2.6.3 - Authenticated (Admin+) SQL Injection
4.9
CVE-2024-10499
Nov 21, 2024
Researcher: Emiliano Versini
AI Engine <= 2.4.7 - Authenticated (Admin+) SQL Injection
4.9
CVE-2024-6723
Aug 22, 2024
Researcher: Karolis Narvilas
AI Engine <= 2.5.0 - Authenticated (Admin+) Remote Code Execution
7.2
CVE-2024-6451
Jul 29, 2024
Researcher: Karolis Narvilas
AI Engine <= 2.4.7 - Authenticated (Subscriber+) Server-Side Request Forgery
6.4
CVE-2024-38791
Jul 22, 2024
Researcher: Yuchen Ji
AI Engine: ChatGPT Chatbot <= 2.2.63 - Authenticated (Editor+) Arbitrary File Upload
9.1
CVE-2024-34440
May 7, 2024
Researcher: stealthcopter
AI Engine <= 2.1.4 - Authenticated (Editor+) Server-Side Request Forgery
6.4
CVE-2024-29090
Mar 26, 2024
Researcher: Rafie Muhammad
Title Status CVE ID CVSS Researchers Date
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.4.9 - Authenticated (Editor+) Privilege Escalation Patched CVE-2026-27407 7.2 Phat RiO May 28, 2026
AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token Patched CVE-2026-8719 8.8 daroo May 16, 2026
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload Patched CVE-2026-23802 7.2 0xd4rk5id3 February 25, 2026
AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint Patched CVE-2026-1400 7.2 type5afe January 27, 2026
AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery Patched CVE-2026-0746 6.4 type5afe January 27, 2026
AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery Patched CVE-2025-8084 6.8 Jonas Benjamin Friedli November 18, 2025
AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization Patched CVE-2025-12844 7.1 ISMAILSHADOW November 12, 2025
AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation Patched CVE-2025-11749 9.8 Emiliano Versini November 4, 2025
Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion Patched CVE-2025-8268 6.5 ISMAILSHADOW September 3, 2025
AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload Patched CVE-2025-7847 8.8 ISMAILSHADOW July 30, 2025
AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions Patched CVE-2025-7780 6.5 ISMAILSHADOW July 23, 2025
AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter Patched CVE-2025-5570 5.4 mikemyers July 7, 2025
AI Engine 2.8.4 - Insecure OAuth Implementation Patched CVE-2025-6238 8.0 István Márton July 3, 2025
AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP Patched CVE-2025-5071 8.8 István Márton June 18, 2025
AI Engine <= 2.6.3 - Authenticated (Admin+) SQL Injection Patched CVE-2024-10499 4.9 Emiliano Versini November 21, 2024
AI Engine <= 2.4.7 - Authenticated (Admin+) SQL Injection Patched CVE-2024-6723 4.9 Karolis Narvilas August 22, 2024
AI Engine <= 2.5.0 - Authenticated (Admin+) Remote Code Execution Patched CVE-2024-6451 7.2 Karolis Narvilas July 29, 2024
AI Engine <= 2.4.7 - Authenticated (Subscriber+) Server-Side Request Forgery Patched CVE-2024-38791 6.4 Yuchen Ji July 22, 2024
AI Engine: ChatGPT Chatbot <= 2.2.63 - Authenticated (Editor+) Arbitrary File Upload Patched CVE-2024-34440 9.1 stealthcopter May 7, 2024
AI Engine <= 2.1.4 - Authenticated (Editor+) Server-Side Request Forgery Patched CVE-2024-29090 6.4 Rafie Muhammad March 26, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation