CVE-2024-0699 AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url

What is CVE-2024-0699?

CVE-2024-0699 is a medium-severity vulnerability in tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress, published on 5 Feb 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_image_from_url' function in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Editor access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2024-29100 is likely a duplicate of this issue.

Weakness: CWE-434

Which versions are affected by CVE-2024-0699?

It affects 1 product.

Products include Meowapps Ai Engine.

How do I fix CVE-2024-0699?

No fix has been published for CVE-2024-0699 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-0699 being exploited?

There is no known exploitation of CVE-2024-0699 in the wild and no public exploit code.

Other vulnerabilities in tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress

• CVE-2023-51409 WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability Critical 10.0
• CVE-2024-34440 WordPress AI Engine plugin <= 2.2.63 - Auth. Arbitrary File Upload vulnerability Critical 9.1
• CVE-2024-29100 WordPress AI Engine plugin <= 2.1.4 - Arbitrary File Upload vulnerability Critical 9.1
• CVE-2025-5071 AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP High 8.8
• CVE-2025-6238 AI Engine 2.8.4 - Insecure OAuth Implementation High 8.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7m74-4w6g-p6gf.