---
id: CVE-2026-107745
title: >-
  AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion
  via 'metadata' Parameter
summary: >-
  The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for
  WordPress is vulnerable to limited media file deletion due to insufficient
  file path validation in the upload_file function in all versions up to, and
  including, 3.…
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-22
vendor: tigroumeow
product: >-
  AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT &
  Gemini
affected:
  - >-
    ai_engine_mcp_server_ai_chatbot_for_wordpress_with_claude_chatgpt_gemini <=
    3.8.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T01:32:09.199540Z'
published: '2026-10-28'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T01:51:59.196Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107745'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/d4f8607c-711e-4d0e-8379-49346033a837?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/classes/modules/files.php#L470
  - url: >-
      https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/classes/modules/files.php#L62
  - url: >-
      https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/classes/modules/files.php#L1071
  - url: >-
      https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/classes/api.php#L689
  - url: >-
      https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/classes/api.php#L1040
  - url: >-
      https://plugins.trac.wordpress.org/changeset?old_path=%2Fai-engine%2Ftags%2F3.8.4%2Fclasses%2Fmodules%2Ffiles.php&new_path=%2Fai-engine%2Ftags%2F3.8.5%2Fclasses%2Fmodules%2Ffiles.php
tags:
  - cve.org
epss: 0.00322
epssPercentile: 0.25194
ingestedAt: '2026-10-28T03:02:57.609Z'
---

## Overview

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.

## Affected

- `ai_engine_mcp_server_ai_chatbot_for_wordpress_with_claude_chatgpt_gemini <= 3.8.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.