CVE-2025-8268
Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the rest_list and delete_files functions in all versions up to, and including, 2.9.5. This makes it possible for unauthenticated attackers to list and delete files uploaded by other users.
| CWE | CWE-862 |
| Vendor | tigroumeow |
| Product | ai engine – the chatbot, ai framework & mcp for wordpress |
| Published | Sep 3, 2025 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress
Be the first to know when new medium vulnerabilities affecting tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
tigroumeow / AI Engine – The Chatbot, AI Framework & MCP for WordPress
0 ≤ 2.9.5
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/be39e24f-d7d7-44db-9ffd-a4605de8e577?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.5/classes/modules/files.php#L645 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.5/classes/modules/files.php#L518 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.5/classes/modules/files.php#L664
Credits
ISMAILSHADOW