CVE-2026-110976
AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.
| Vendor | unknown |
| Product | ai engine |
| Published | Oct 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown ai engine
Be the first to know when new unknown vulnerabilities affecting unknown ai engine are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / AI Engine
0 < 3.7.9
References
Credits
Karthik Ramakrishnan WPScan