CVE-2026-65545

Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This issue affects AI Engine: from n/a through 3.8.8.

The Meow Apps AI Engine plugin contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects AI Engine from n/a through 3.8.6.

The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object. This allows users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.

The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it. This allows users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.

The AI Engine plugin by Meow Apps contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects AI Engine from n/a through 3.8.3.

The AI Engine plugin in versions up to 3.7.8 contains an Insecure Direct Object References (IDOR) vulnerability that allows an unauthenticated attacker to access objects they should not have permission to. The lack of authentication on object references enables manipulation of identifiers to gain unauthorized access.

The AI Engine WordPress plugin before version 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors. This allows unauthenticated attackers to run AI queries of their own choosing against the site owner's configured provider account.

The AI Engine WordPress plugin before version 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them. This requires a non-default public API feature to be enabled; otherwise the issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read network-shared configuration and secrets.

The AI Engine WordPress plugin before version 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled.

AI Engine versions up to 3.4.9 have a vulnerability that allows for editor privilege escalation.