{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-07-04T05:02:12.713","vulnerabilities":[{"cve":{"id":"CVE-2026-0746","sourceIdentifier":"security@wordfence.com","published":"2026-01-27T19:16:13.460","lastModified":"2026-06-17T10:11:18.547","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the 'get_audio' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, if \"Public API\" is enabled in the plugin settings, and 'allow_url_fopen' is set to 'On' on the server."},{"lang":"es","value":"El plugin AI Engine para WordPress es vulnerable a falsificación de petición del lado del servidor en todas las versiones hasta la 3.3.2, inclusive, a través de la función 'get_audio'. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, realicen peticiones web a ubicaciones arbitrarias originadas desde la aplicación web y puede usarse para consultar y modificar información de servicios internos, si la 'API Pública' está habilitada en la configuración del plugin, y 'allow_url_fopen' está configurado en 'On' en el servidor."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"tigroumeow","product":"AI Engine – The Chatbot, AI Framework & MCP for WordPress","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.3.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-28T14:05:46.546803Z","id":"CVE-2026-0746","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.3.1/classes/engines/chatml.php#L946","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3447500/ai-engine/trunk/classes/engines/chatml.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbba866d-93dd-4ef5-9670-ab958f61f06e?source=cve","source":"security@wordfence.com"}]}}]}