CVE-2026-111041: AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media

Q: Which users can exploit this issue?

Users with the WordPress Editor role or any higher-privileged role can exploit the affected AI media management actions. The issue enables them to target posts they do not otherwise have permission to edit.

Q: What can an attacker change?

An affected user can modify arbitrary posts and can change a targeted post's type through the update_media_metadata and approve_media actions.

Q: Which versions should be remediated?

AI Engine versions earlier than 3.7.9 are affected. Update the plugin to version 3.7.9 or later.

Q: What can be done if updating is not immediately possible?

Restrict or remove Editor access for untrusted users, since Editor-level access is sufficient to perform the unauthorized modifications. Review use of the affected AI media management actions.

Published Oct 18, 2026

Updated

The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.

Affected Software

1 affected component

Meow Apps AI Engine<3.7.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade AI Engine WordPress plugin to a version that resolves this vulnerability.
Fixed in 3.7.9

Event History

Oct 18, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Users with the WordPress Editor role or any higher-privileged role can exploit the affected AI media management actions. The issue enables them to target posts they do not otherwise have permission to edit.

What can an attacker change?

An affected user can modify arbitrary posts and can change a targeted post's type through the update_media_metadata and approve_media actions.

Which versions should be remediated?

AI Engine versions earlier than 3.7.9 are affected. Update the plugin to version 3.7.9 or later.

What can be done if updating is not immediately possible?

Restrict or remove Editor access for untrusted users, since Editor-level access is sufficient to perform the unauthorized modifications. Review use of the affected AI media management actions.

CVE-2026-111041: AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users can exploit this issue?

What can an attacker change?

Which versions should be remediated?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What can an attacker change?

Which versions should be remediated?

What can be done if updating is not immediately possible?