CVE-2026-89141— AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter
Quick assessment
Affected
tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件“The AI Engine – The Chatbot, AI Framework & MCP”在 3.7.7 及更早的所有版本中，由于对用户可控的 'mediaId' 参数缺乏校验，存在不安全直接对象引用（Insecure Direct Object Reference, IDOR）漏洞。这使得拥有订阅者权限或更高权限的已认证攻击者，可以通过提供附件 ID 来访问并获取属于其他用户（包括管理员）的私有音频附件的转录内容。该漏洞要求在插件设置中启用“公共 API”模块；若该模块未启用，则对
Possible ATT&CK Techniques 1 AI
T1537 · Transfer Data to Cloud Account
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89141
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to access and retrieve the transcribed contents of private audio attachments belonging to other users, including Administrators, via a supplied attachment ID. This vulnerability requires the Public API module to be enabled in the plugin settings; when disabled, the REST route is absent and the endpoint returns HTTP 404.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| tigroumeow | AI Engine – The Chatbot, AI Framework & MCP for WordPress | 0 ~ 3.7.7 | - |
|
II. Public POCs for CVE-2026-89141
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89141
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-89141 (1)
Security Blog Posts for CVE-2026-89141 (1)
IV. Related Vulnerabilities
-
CVE-2026-15988
AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege -
CVE-2026-8719
AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Esca -
CVE-2026-1400
AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File -
CVE-2026-0746
AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side -
CVE-2025-8084
AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Req
Same vendor: tigroumeow
-
CVE-2026-15988
AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege -
CVE-2026-4912
Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticate -
CVE-2025-6784
Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote C -
CVE-2026-1291
Meow Gallery <= 5.4.4 - Missing Authorization to Authenticat -
CVE-2026-8719
AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Esca
Same weakness: CWE-639
-
CVE-2026-90858
subhajitkhan online-clinic-management-system adminappview.ph -
CVE-2026-91773
Soft Serve 0.7.1 through 0.11.6 Information Disclosure via L -
CVE-2026-91770
IceHRM before 36.0.0 Broken Access Control via Employee ID -
CVE-2026-91144
ZFile through 5.0.5 Share Entry Filter Bypass via Download E -
CVE-2026-54180
backpack/crud: CRUD panel query scopes are not enforced on U
V. Comments for CVE-2026-89141
No comments yet