CVE-2026-1400: tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress
Vulnerability summary
CVE-2026-1400 is a high (CVSS 7.2) vulnerability in tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.6% of scored vulnerabilities. Fixed in 3.3.3.
Timeline
- 28-01-2026PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `rest_helpers_update_media_metadata` function in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The attacker can upload a benign image file, then use the `update_media_metadata` endpoint to rename it to a PHP file, creating an executable PHP file in the uploads directory.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.74%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
+0.04 pp
From 0.69% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Tigroumeow1 product
Wordpress1 product
- ai-engine≤ 3.3.2 (fixed in 3.3.3)
2 vendors · 2 products