CVE-2026-16953: AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie
The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16953?
CVE-2026-16953 has a risk score of 33, indicating a moderate level of severity.
How do I fix CVE-2026-16953?
To fix CVE-2026-16953, update the AI Engine WordPress plugin to version 3.6.4 or later.
What type of vulnerability is CVE-2026-16953?
CVE-2026-16953 is an unauthenticated cross-session vulnerability that allows file deletion via a forgeable session cookie.
What is affected by CVE-2026-16953?
CVE-2026-16953 affects the AI Engine WordPress plugin versions prior to 3.6.4.
Who can exploit CVE-2026-16953?
An unauthenticated attacker who obtains a victim's session identifier and file reference can exploit CVE-2026-16953.