What happened
The AI Engine plugin (before 3.7.9) fails to verify that an item passed to its media actions belongs to the requesting user (CWE-862, CVSS 4.9). This lets Editor+ users delete arbitrary posts of any type via one flaw (CVE-2026-110976) and modify/change the type of arbitrary posts via a sibling flaw (CVE-2026-111041).
Why it matters
An authorization gap in an AI-generation plugin lets a content-duty user escalate to modifying or deleting site-wide content (nav menus, block templates, global styles) outside their role, impacting any organization running AI content workflows on WordPress.
Attack vector
An Editor+ user calls an AI media action without the plugin verifying ownership/authorization of the target object, permanently deleting arbitrary posts (CVE-2026-110976) or modifying/changing the type of arbitrary posts (CVE-2026-111041), including content they otherwise cannot touch.
Affected systems
AI Engine WordPress plugin before 3.7.9
Mitigation
Upgrade to 3.7.9 or later. WPScan advisories c42eabbf-f357-46cd-b008-1b18eba83bf7 and 829fef5b-915c-4762-a90d-47a08d78266b.