CVE-2026-16953: Unknown Ai Engine

Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days.

The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.

Affected products

• Unknown Ai Engine: before 3.6.4 (fixed in 3.6.4)

Published 2026-08-08. Last modified 2026-08-26.