Auth bypass in Ai Engine
CVE-2026-16953
The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.
Vulnerability class: IDOR (Insecure Direct Object Reference)
EPSS: 0.002 (8.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L.
Affected products
- Unknown Ai Engine — versions 0
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-16953?
- CVE-2026-16953 is a medium-severity vulnerability in Ai Engine, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.8/10. Published 2026-08-08.
- How severe is CVE-2026-16953?
- Medium severity. CVSS v3 base score is 4.8 out of 10.