Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: AI Engine 3.7.2 Clear all filters
TI-2026-53054 CVE-2026-75798 · GHSA-m6p4-v4cr-fqfp

AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant

Priority LOW 30

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated atta…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00304 Published 2026-08-26 Fixed in 3.7.2 CWE-862
TI-2026-53053 CVE-2026-75797 · GHSA-v7cm-6545-2w7m

AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter

Priority LOW 34

The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users wit…

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00443 Published 2026-08-26 Fixed in 3.7.2 CWE-22