CVE-2026-110976: AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media
The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
A user with the WordPress Editor role or a higher-privileged role can exploit it. The issue permits deletion of posts that the user would not normally be authorized to delete.
What does an attacker need to do to exploit it?
The attacker needs an authenticated WordPress account with the Editor role or above and must invoke an affected AI Engine media action with an item that belongs to another user or is otherwise outside their normal deletion permissions.
What content could be affected?
An attacker can permanently delete arbitrary posts of any type. This includes navigation menus, block templates, and global styles, as well as other content the Editor would ordinarily be unable to delete.
Which versions are affected?
AI Engine versions before 3.7.9 are affected. Updating to version 3.7.9 or later removes the described vulnerable behavior.