CVE-2026-89141: tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress

Vulnerability summary

CVE-2026-89141 is a medium (CVSS 6.5) vulnerability in tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 38% of scored vulnerabilities. Fixed in 3.7.8.

Timeline

1. 15-09-2026
   PublishedVulnerability first disclosed.
2. 15-09-2026
   Last modifiedVulnerability information updated.

Description

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to access and retrieve the transcribed contents of private audio attachments belonging to other users, including Administrators, via a supplied attachment ID. This vulnerability requires the Public API module to be enabled in the plugin settings; when disabled, the REST route is absent and the endpoint returns HTTP 404.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.