CVE-2025-8268: Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion
The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the restlist and deletefiles functions in all versions up to, and including, 2.9.5. This makes it possible for unauthenticated attackers to list and delete files uploaded by other users.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8268?
CVE-2025-8268 is considered a high severity vulnerability due to its potential for unauthorized access and data loss.
How do I fix CVE-2025-8268?
To fix CVE-2025-8268, you should update the AI Engine plugin for WordPress to the latest version beyond 2.9.5.
Who is affected by CVE-2025-8268?
CVE-2025-8268 affects all installations of the AI Engine plugin for WordPress versions up to and including 2.9.5.
What can an attacker do with CVE-2025-8268?
An attacker can exploit CVE-2025-8268 to list and delete files without authentication, compromising the website's integrity.
Is authentication required to exploit CVE-2025-8268?
No, CVE-2025-8268 can be exploited by unauthenticated users, making it particularly dangerous.