---
id: CVE-2026-111041
title: >-
  AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via
  update_media_metadata and approve_media
summary: >-
  The AI Engine  WordPress plugin before 3.7.9 does not verify that the user
  performing certain AI media management actions owns or is otherwise allowed to
  edit the targeted object, allowing users with the Editor role or above to
  modify, o…
severity: none
cwe:
  - CWE-862
product: AI Engine
affected:
  - ai_engine < 3.7.9
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T06:00:16.875Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111041'
references:
  - url: 'https://wpscan.com/vulnerability/829fef5b-915c-4762-a90d-47a08d78266b/'
tags:
  - cve.org
ingestedAt: '2026-10-18T06:38:27.434Z'
---

## Overview

The AI Engine  WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.

## Affected

- `ai_engine < 3.7.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.