CVE-2026-107745 AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-107745?
CVE-2026-107745 is a medium-severity vulnerability in tigroumeow AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini, published on 28 Oct 2026.
Official description
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.
Weakness: CWE-22
Which versions are affected by CVE-2026-107745?
How do I fix CVE-2026-107745?
No fix has been published for CVE-2026-107745 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-107745 being exploited?
There is no known exploitation of CVE-2026-107745 in the wild and no public exploit code.
Sources
Also known as GHSA-xfc5-7gqh-v42g.