High · published January 28, 2026
🚨 An Editor-level user can upload a file and *poof*—turn it into a PHP script! This arbitrary file upload vulnerability in the AI Engine for WordPress is a game-changer for attackers! ⚡ Think of it like a hotel guest who checks in with a suitcase but then starts storing suspicious items in the hotel’s storage area without any checks. If the staff doesn't verify what's inside, who knows what could end up in the building? An attacker could exploit this vulnerability to upload a seemingly harmless file, later morphing it into a malicious PHP script that could compromise the entire server. This means they could execute arbitrary code, potentially leading to data theft, site defacement, or worse! Yikes!
Think of it like a hotel guest who checks in with a suitcase but then starts storing suspicious items in the hotel’s storage area without any checks. If the staff doesn't verify what's inside, who knows what could end up in the building? The vulnerability arises from missing file type validation in the `rest_helpers_update_media_metadata` function in versions up to and including 3.3.2. This allows authenticated users with Editor-level access or higher to upload arbitrary files without proper checks.
An attacker could exploit this vulnerability to upload a seemingly harmless file, later morphing it into a malicious PHP script that could compromise the entire server. This means they could execute arbitrary code, potentially leading to data theft, site defacement, or worse! Yikes! Update the AI Engine plugin to version 3.3.3 or later immediately to close this gaping hole. Additionally, review user permissions to ensure only trusted users have Editor-level access or above. Don't forget to regularly audit all uploaded files for suspicious activity! You've got this! Patch the plugin and secure your site—you're on your way to becoming a security hero! 🛡️