AI Engine < 3.5.5 – Editor+ Arbitrary File Write via Path Traversal | CVE 2026-12511

Description

The plugin does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.

Proof of Concept

Prerequisite: an authenticated Editor (or Administrator) session. The route uses the wp_rest nonce only as cookie-auth transport (any logged-in user obtains it from any wp-admin page); the authorization gate is the editor/administrator role check.

Send a create-image request whose url returns image/* content (a data: URL works, no external host needed) and whose filename contains a path-traversal sequence with an allowed extension:

curl -k -b EDITOR_COOKIES -H "X-WP-Nonce: <wp_rest nonce>" -H "Content-Type: application/json" \
  -X POST "https://victim.example/wp-json/mwai/v1/helpers/create_image" \
  --data '{"url":"data:image/png;base64,QVRUQUNLRVJfQ09OVFJPTExFRF9CWVRFUw==","filename":"../../../evil.png","title":"poc"}'
# => {"success":true,"attachmentId":N}

After the request, evil.png is written to wp-content/ (three levels above uploads/YYYY/MM/) with content equal to the decoded attacker bytes. Using filename=../../../plugins/evil.png writes into the plugins directory; the file content is fully attacker-controlled (the body of the supplied url). Sending filename=../../../shell.php returns {"success":false,"message":"Invalid custom file type."}, confirming the extension allowlist is the only control while the destination path is attacker-controlled. Existing files are not overwritten (a uniqueness suffix is appended), so the impact is planting new non-executable files at arbitrary locations, not code execution.