PT-2026-4993 · WordPress · Ai Engine

Type5Afe · Published 2026-01-27 · Updated 2026-01-27 · CVE-2026-0746

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AI Engine plugin for WordPress versions up to and including 3.3.2

Description The AI Engine plugin for WordPress is susceptible to Server-Side Request Forgery via the get audio function. An authenticated attacker with Subscriber-level access or higher can make web requests to arbitrary locations originating from the web application. This can be used to query and modify information from internal services if the "Public API" is enabled in the plugin settings and allow url fopen is set to 'On' on the server.

Recommendations Update the AI Engine plugin to a version later than 3.3.2.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-0746

Affected Products

Ai Engine

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-0746 · Security Note
• https://twitter.com/CVEnew/status/2016226148640862468 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3447500/ai-engine/trunk/classes/engines/chatml.php · Note
• https://twitter.com/VulmonFeeds/status/2016269056320401501 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/cbba866d-93dd-4ef5-9670-ab958f61f06e?source=cve · Note
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.3.1/classes/engines/chatml.php#L946 · Note