Detections
Analytics

CVE-2026-12511

high

Description

The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.

References

https://wpscan.com/vulnerability/cf3cf59e-da36-429b-8794-5a46587e8462/

Details

Source: Mitre, NVD

Published: 2026-07-14

Updated: 2026-07-14

Risk Information

CVSS v2

Base Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 8.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Severity: High