Executive brief
AI Engine is a WordPress plugin that adds AI-powered features including audio transcription. The plugin fails to validate file paths supplied by users, allowing authenticated attackers to read arbitrary files from the server and exfiltrate them to external services. At subscriber level, exploitation requires a non-default public API setting to be enabled; administrators can exploit this by default on multisite installations to access sensitive network configuration and secrets.
Technical details
This is a local file inclusion (LFI) vulnerability in the audio transcription endpoint of the AI Engine plugin. The vulnerable component fails to restrict user-supplied file paths before reading them and forwarding their contents to an external transcription service. Two attack paths exist: (1) administrators can exploit the `/wp-json/mwai/v1/ai/transcribe_audio` endpoint without additional configuration to read files like wp-config.php, and (2) subscribers can exploit `/wp-json/mwai/v1/simpleTranscribeAudio` if the public API feature is enabled, bypassing a basic path filter through parameter name normalization (e.g., "path_" becomes "path" after filtering). The attacker must have valid REST nonce access and the WordPress instance must be network-reachable; files are exfiltrated via multipart POST requests to an attacker-controlled endpoint. The vulnerability is fixed in version 3.6.6.
Affected products
- Wordpress.org AI Engine before 3.6.6
Timeline
- 2026-08-03: disclosed
- 2026-08-03: patched: Fixed in version 3.6.6
- 2026-08-08: advisory