PULSE
LIVE7signals / 24h
ES
FEED
ransomincransom reclama a Louisville Bar Association · US · Professional Servicesransomqilin reclama a Clausing · DE · Manufacturingransomqilin reclama a CLLS Co Ltd · SG · Not Foundransomstorm reclama a United Group of Companies · US · Otherransomstorm reclama a Sawyer Savings Bank · US · Financial Servicesransombravox reclama a MEDICOS · FR · Healthcareransomspacebears reclama a Hitech Distribuzione Informatica S.r.l. (HTDI) · IT · Technologyransomstorm reclama a Pioneer Bank · US · Financial Servicesransomthegentlemen reclama a Hartfiel Automation · DE · Manufacturingransomqilin reclama a Astro Electroplating · US · Manufacturingransomqilin reclama a Filtronic · GB · Manufacturingransomqilin reclama a EISNER ZT GMBH · AT · Professional Servicesransomqilin reclama a John C Saunders, CPA · US · Professional Servicesransomqilin reclama a Nikan Awasisak Agency · CA · Not Foundransomincransom reclama a Louisville Bar Association · US · Professional Servicesransomqilin reclama a Clausing · DE · Manufacturingransomqilin reclama a CLLS Co Ltd · SG · Not Foundransomstorm reclama a United Group of Companies · US · Otherransomstorm reclama a Sawyer Savings Bank · US · Financial Servicesransombravox reclama a MEDICOS · FR · Healthcareransomspacebears reclama a Hitech Distribuzione Informatica S.r.l. (HTDI) · IT · Technologyransomstorm reclama a Pioneer Bank · US · Financial Servicesransomthegentlemen reclama a Hartfiel Automation · DE · Manufacturingransomqilin reclama a Astro Electroplating · US · Manufacturingransomqilin reclama a Filtronic · GB · Manufacturingransomqilin reclama a EISNER ZT GMBH · AT · Professional Servicesransomqilin reclama a John C Saunders, CPA · US · Professional Servicesransomqilin reclama a Nikan Awasisak Agency · CA · Not Found
← All CVEs
CVE WatchAug 8, 2026

CVE-2026-16953

The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Aug 8, 2026 · Last modified: Aug 8, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.

Official references
Related CVEs

No related CVEs by CWE or product.