CVE-2026-16955: AI Engine WordPress Path Traversal Flaw

CVE-2026-16955 Overview

CVE-2026-16955 is a path traversal vulnerability [CWE-22] in the AI Engine WordPress plugin before version 3.6.6. The plugin fails to confine a caller-supplied file path before reading its contents and forwarding them to an external service. Authenticated users can read arbitrary files from the server and exfiltrate them off-host.

Reaching the issue at subscriber level requires the plugin's non-default public API feature to be enabled. When that feature is disabled, the same code path remains reachable by administrators. On multisite installations, this permits a non-super subsite administrator to read the network-shared configuration and its stored secrets.

Critical Impact
Authenticated users can read arbitrary files, including WordPress multisite configuration secrets, and exfiltrate them to an attacker-controlled external service.

Affected Products

AI Engine WordPress plugin versions prior to 3.6.6
WordPress single-site installations with the public API feature enabled
WordPress multisite installations running the plugin at any administrator level

Discovery Timeline

2026-08-08 - CVE-2026-16955 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-16955

Vulnerability Analysis

The AI Engine plugin exposes functionality that accepts a file path parameter from the caller. The plugin reads the referenced file and passes its contents to an external AI service without validating that the path stays within an expected directory. This design allows an attacker to substitute paths that traverse outside the intended scope using sequences such as ../ or absolute paths to sensitive files.

Because the file contents flow to a remote service under the request, the vulnerability doubles as both arbitrary file read and off-host data exfiltration. Targets include wp-config.php, private keys, log files, and, on multisite deployments, the network-shared configuration containing database credentials and authentication secrets.

The attack surface widens depending on configuration. With the plugin's public API feature enabled, a subscriber-tier account is sufficient. With the feature disabled, the caller must hold administrator privileges, but on multisite this still allows a subsite administrator to escalate beyond their intended scope by reading network-wide secrets.

Root Cause

The root cause is missing path canonicalization and allow-list validation before the file read operation. The plugin trusts the caller-supplied path and does not enforce a base directory constraint. This is a classic path traversal pattern tracked as [CWE-22].

Attack Vector

An authenticated user submits a request to the vulnerable plugin endpoint containing a manipulated file path parameter. The plugin resolves the path, reads the file, and forwards the contents to the configured external AI service. The attacker receives the exfiltrated data either through the service response or by controlling the receiving endpoint. No user interaction is required beyond the initial request. Refer to the WPScan Vulnerability Report for technical specifics.

Detection Methods for CVE-2026-16955

Indicators of Compromise

Web server access logs showing authenticated requests to AI Engine plugin endpoints with path parameters containing ../, absolute filesystem paths, or references to wp-config.php.
Outbound HTTPS connections from the WordPress host to external AI service endpoints correlated with unusually large request bodies.
Unexpected subscriber or subsite administrator activity targeting plugin API routes.

Detection Strategies

Review AI Engine plugin logs and application logs for file path parameters that resolve outside the plugin's expected working directory.
Correlate authenticated plugin requests with outbound egress volume to identify file exfiltration patterns.
Audit WordPress user roles and flag subscriber accounts issuing requests to administrative or AI-related plugin endpoints.

Monitoring Recommendations

Enable WordPress audit logging to capture plugin invocations, request parameters, and the authenticated user identity.
Monitor egress traffic from WordPress hosts to third-party AI APIs and alert on payload size anomalies.
Track plugin version inventory across WordPress estates to identify hosts still running AI Engine below 3.6.6.

How to Mitigate CVE-2026-16955

Immediate Actions Required

Update the AI Engine plugin to version 3.6.6 or later on every WordPress site.
Disable the plugin's public API feature unless it is required for business operations.
Rotate secrets stored in wp-config.php and multisite network configuration if compromise is suspected.
Audit subscriber-tier accounts and remove or downgrade accounts that are not required.

Patch Information

The vendor fixed CVE-2026-16955 in AI Engine version 3.6.6. Upgrading to this release or later confines the caller-supplied file path and blocks arbitrary file reads. See the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the AI Engine plugin until it can be updated to version 3.6.6 or later.
Restrict access to the plugin's REST endpoints at the web server or WAF layer for non-administrative users.
On multisite, temporarily deactivate the plugin at the network level to prevent subsite administrator abuse.

bash

# Configuration example: force plugin update via WP-CLI
wp plugin update ai-engine --version=3.6.6
wp plugin list --name=ai-engine --fields=name,status,version