CyberRota Analysis
AI-GeneratedThe AI Engine WordPress plugin prior to version 3.6.4 is vulnerable due to inadequate verification of ownership for uploaded chatbot files, relying solely on a client-supplied session cookie for authorization. This flaw allows unauthenticated attackers who acquire a victim's session identifier to delete their uploaded files, potentially leading to data loss and service disruption. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.