Unrated
AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media
The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.
Announced Source revision 1
Original source ↗CVE-2026-111041
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-111041
AI Engine
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Unknown",
"product": "AI Engine",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "3.7.9",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-111041
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #34571 · Revision 1
- Added to Heist Feed
- Publisher date