Description

The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-26T06:16:27.230Z",
  "pubdate": "2026-08-26T06:16:27.230Z",
  "executiveSummary": "The AI Engine WordPress plugin before version 3.7.2 contains a critical vulnerability involving improper validation of user-supplied URLs during file mapping operations. This flaw facilitates an Arbitrary File Read vulnerability, enabling unauthorized access to sensitive local filesystem data.\nThe vulnerability occurs because the plugin fails to perform adequate path sanitization when mapping a caller-supplied URL to a local file path before initiating a read operation and forwarding the content to an external service. The impact is significant, as it allows for the exfiltration of sensitive server-side files, including configuration files and proprietary data.\nExploitation requirements vary based on the configuration of the target environment. If the non-default public API feature is enabled, a subscriber-level user can successfully exploit this vulnerability. In environments where this feature is disabled, the vulnerability remains reachable by an administrator. Notably, in a WordPress multisite architecture, this flaw permits a subsite administrator to bypass security boundaries and access network-shared configuration secrets. This vulnerability poses a severe risk to confidentiality and overall system integrity, requiring immediate remediation through version updates.",
  "technicalDetails": "The vulnerability resides within the AI Engine plugin's file handling mechanism, which manages the mapping of URLs to local filesystem resources. The root cause is a lack of strict input validation or path normalization when processing user-provided URL inputs that are subsequently passed to internal file-reading functions. By manipulating the input URL, an attacker can perform path traversal or target sensitive files residing outside the intended directory structure.\nThe exploitation flow begins with the attacker supplying a malicious URL to the vulnerable API endpoint. Because the application logic maps this URL to the local filesystem without sufficiently confining the path to a designated sandbox, the system interprets the input as a request to read a specific local file. Upon receiving the input, the plugin reads the specified file contents from the server's disk.\nFollowing the read operation, the plugin forwards the retrieved file contents to an external service. This design choice enables the attacker to exfiltrate arbitrary files off-host, circumventing standard filesystem permissions and security controls. In scenarios where the public API feature is enabled, the attack surface is accessible to authenticated users with subscriber-level privileges. Without this feature, the vulnerability is limited to administrative users; however, the impact remains critical, particularly in multisite deployments.\nIn a multisite context, the vulnerability allows an attacker with subsite administrative privileges to read sensitive files belonging to the network-shared configuration. This effectively breaks the isolation between subsites and the main network configuration, potentially exposing database credentials, API keys, and other critical secrets stored in environment or configuration files. The lack of proper filesystem boundary enforcement makes the server vulnerable to full information disclosure. The exploitation does not necessarily require complex payload injection but relies on the ability to pass arbitrary paths through the URL parameter, leading to the plugin inadvertently treating sensitive local files as legitimate requests for external processing. This mechanism bypasses typical PHP open_basedir restrictions if the file-handling logic uses internal functions that do not respect those settings, or if the server configuration is overly permissive."
}