CVE-2026-107745

AI Engine upload metadata can redirect expired-media cleanup

Meow Apps / tigroumeow · AI Engine WordPress chatbot and MCP framework

First documented disclosure · Review checkpoint

Summary

A subscriber can influence which media file the hourly cleanup deletes.

Severity and exploitation evidence

Medium · 4.2/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources do not establish malicious exploitation or a confirmed victim incident.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Upload metadata reaches internal file-management state without sufficient path validation.

Conditions required

Subscriber-or-higher account, Public API enabled by an administrator, and subsequent hourly cleanup.

Potential impact

Deletion of media files; broader arbitrary-file deletion is not established.

Affected versions and configurations

All versions through 3.8.4.

Fix and mitigation status

3.8.5.

Practical next steps

Upgrade to a current patched release; restrict Public API access.

Operating lesson

Keep client metadata separate from internal file lifecycle state.

Evidence and limits

The October 14 version 3.8.5 changelog explicitly describes the metadata and cleanup correction. Wordfence disclosed details October 27; the CNA record followed October 28.

Sources