WordPress Plugin Vulnerabilities

Ai Engine < 2.9.6 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion

Description

The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the rest_list and delete_files functions in all versions up to, and including, 2.9.5. This makes it possible for unauthenticated attackers to list and delete files uploaded by other users.

Affects Plugins

Plugin icon
ai-engine
Fixed in 2.9.6

References

CVE
CVE-2025-8268
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/be39e24f-d7d7-44db-9ffd-a4605de8e577

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
ISMAILSHADOW
Verified
No
WPVDB ID
0247de3a-2143-4847-aa82-d0ed32419e85

Timeline

Publicly Published
2025-09-03 (about 8 months ago)
Added
2025-09-03 (about 8 months ago)
Last Updated
2025-09-03 (about 8 months ago)

Other

Published
Title
Published
2025-12-23
Title
e-xact-hosted-payment <= 2.0 - Unauthenticated Arbitrary File Deletion
Published
2023-09-04
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.6.15 - Missing Authorization to Settings Update
Published
2025-03-31
Title
StaticPress <= 0.4.5 - Missing Authorization
Published
2025-01-16
Title
PAPERCITE <= 0.5.18 - Missing Authorization
Published
2025-03-11
Title
Responsive Google Map <= 3.1.5 - Missing Authorization