PT-2026-57965 · Undefined · Undefined
Published
2026-07-14
·
Updated
2026-07-14
·
CVE-2026-12511
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Undefined