CVE-2026-111041: AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media
The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AI Engine WordPress pluginto a version that resolves this vulnerability.Fixed in 3.7.9
Event History
Frequently Asked Questions
Which users can exploit this issue?
Users with the WordPress Editor role or any higher-privileged role can exploit the affected AI media management actions. The issue enables them to target posts they do not otherwise have permission to edit.
What can an attacker change?
An affected user can modify arbitrary posts and can change a targeted post's type through the update_media_metadata and approve_media actions.
Which versions should be remediated?
AI Engine versions earlier than 3.7.9 are affected. Update the plugin to version 3.7.9 or later.
What can be done if updating is not immediately possible?
Restrict or remove Editor access for untrusted users, since Editor-level access is sufficient to perform the unauthorized modifications. Review use of the affected AI media management actions.