What is CVE-2026-16955?
The AI Engine WordPress plugin before version 3.6.6 fails to confine a caller-supplied file path, allowing subscriber-level users to read arbitrary files from the server and exfiltrate their contents to an external service. Immediate update to version 3.6.6 or later is strongly recommended.
Azərbaycanca: AI Engine WordPress plaqini 3.6.6-dan əvvəlki versiyalarda istifadəçi tərəfindən təqdim edilən fayl yolunu məhdudlaşdırmır. Bu zəiflik abunəçi səviyyəli hesaba malik istifadəçilərə serverdəki ixtiyari faylları oxuyub məzmununu xarici xidmətə sızdırmağa imkan verir. Plaqini ən qısa zamanda 3.6.6 və ya daha yuxarı versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-22
FAQ2
Which versions of the AI Engine plugin are affected by CVE-2026-16955?
All versions of the AI Engine WordPress plugin before 3.6.6 are affected by this vulnerability.
What privilege level of users can read arbitrary files on the server via CVE-2026-16955?
This vulnerability allows subscriber-level users to read arbitrary files from the server.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.