CVE-2026-89141 Overview
CVE-2026-89141 affects the AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin in all versions up to and including 3.7.7. The vulnerability is an Insecure Direct Object Reference [CWE-639] in the mediaId parameter, caused by missing validation on a user-controlled key. Authenticated attackers with subscriber-level access or higher can retrieve transcribed contents of private audio attachments belonging to other users, including Administrators. Exploitation requires the Public API module to be enabled in plugin settings; when disabled, the REST route is absent and the endpoint returns HTTP 404.
Critical Impact
Low-privileged authenticated users can access transcribed audio content belonging to other users, including site Administrators, when the Public API module is enabled.
Affected Products
- AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin, versions ≤ 3.7.7
- WordPress installations with the AI Engine plugin and the Public API module enabled
- Sites where subscriber or higher-privileged accounts are provisioned
Discovery Timeline
- 2026-09-15 - CVE-2026-89141 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-89141
Vulnerability Analysis
The AI Engine plugin exposes a REST endpoint that accepts a mediaId parameter identifying an audio attachment for transcription retrieval. The endpoint authenticates the caller but does not verify that the caller owns or has permission to access the referenced attachment. As a result, any authenticated user can substitute an arbitrary attachment ID and receive the transcribed contents of another user's private audio. The transcription may contain sensitive spoken content authored by administrators or privileged staff. The vulnerability requires the Public API module to be enabled; when the module is disabled the affected REST route is not registered and requests return HTTP 404.
Root Cause
The root cause is a missing authorization check on a user-controlled object identifier, classified as Insecure Direct Object Reference [CWE-639]. The plugin trusts the mediaId supplied by the authenticated client without cross-checking attachment ownership or user capability against the target attachment. See the plugin source references in WordPress AI Engine API Code line 1168 and core.php line 253 for the vulnerable handlers.
Attack Vector
An attacker registers or uses an existing subscriber-level account on a target WordPress site that runs a vulnerable version of AI Engine with the Public API module enabled. The attacker sends authenticated requests to the transcription REST endpoint, iterating or targeting specific mediaId values that reference attachments owned by other users. The endpoint returns the transcribed text for each valid attachment ID regardless of ownership. No user interaction from the victim is required. Refer to the Wordfence Vulnerability Analysis for additional technical detail.
No verified proof-of-concept code is publicly available. See the plugin references linked above for the vulnerable handler locations.
Detection Methods for CVE-2026-89141
Indicators of Compromise
- Authenticated REST API requests from subscriber-level accounts to AI Engine transcription endpoints referencing mediaId values the account did not upload.
- Enumeration patterns in access logs where the same low-privileged user requests sequential or unrelated mediaId values in a short window.
- Unexpected 200 OK responses to transcription endpoints from accounts that have no legitimate authoring history.
Detection Strategies
- Review WordPress access logs for /wp-json/ requests routed to AI Engine handlers and correlate the authenticated user with the ownership of the referenced attachment.
- Alert on any authenticated user retrieving transcriptions for attachments uploaded by a different user, especially when the target is an Administrator.
- Monitor for newly registered subscriber accounts followed by immediate REST API activity against AI Engine endpoints.
Monitoring Recommendations
- Enable verbose logging on the WordPress REST API and forward logs to a centralized analytics platform for correlation.
- Track the state of the AI Engine Public API module setting and alert if it is enabled on sites that do not require it.
- Baseline typical transcription retrieval patterns per user role and alert on deviations.
How to Mitigate CVE-2026-89141
Immediate Actions Required
- Update the AI Engine plugin to a version later than 3.7.7 that includes the fix from changeset 3693379.
- If an update cannot be applied immediately, disable the Public API module in the AI Engine plugin settings to remove the vulnerable REST route.
- Audit existing user accounts and remove unused or unnecessary subscriber-level accounts that could be leveraged for exploitation.
Patch Information
The vendor addressed the issue in the code change published as WordPress AI Engine Changeset 3693379. Site operators should upgrade to the first plugin release that incorporates this changeset. Confirm the deployed plugin version after upgrade through the WordPress admin plugins page.
Workarounds
- Disable the Public API module in AI Engine plugin settings, which removes the affected REST route so the endpoint returns HTTP 404.
- Restrict registration to prevent untrusted users from obtaining subscriber-level access on affected sites.
- Apply Web Application Firewall rules that reject authenticated requests to AI Engine transcription endpoints when the caller does not own the referenced attachment.
# Configuration example: disable open registration in WordPress
wp option update users_can_register 0
# Verify the AI Engine plugin version installed on the site
wp plugin get ai-engine --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
