CyberRota Analysis
AI-GeneratedThe AI Engine WordPress plugin prior to version 3.6.6 is vulnerable due to improper validation of caller-supplied file paths, enabling users with subscriber-level accounts to access and exfiltrate arbitrary files from the server. This vulnerability can also be exploited by non-super subsite administrators in a multisite environment, potentially exposing sensitive network-shared configurations and secrets. WordPress site administrators and security teams should prioritize this issue to mitigate the risk of unauthorized data access.
Original NVD Description
The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.