CVE-2026-0746: 
WordPress vulnerability analysis and mitigation

CVE-2026-0746 is a Server-Side Request Forgery (SSRF) vulnerability in the AI Engine plugin for WordPress, affecting all versions up to and including 3.3.2. The flaw resides in the get_audio function and allows authenticated attackers with Subscriber-level access or higher to make arbitrary web requests originating from the web server. Exploitation requires two specific conditions: the "Public API" setting must be enabled in the plugin, and allow_url_fopen must be set to On on the server. It was published on January 27, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and stems from insufficient validation of user-supplied URLs within the get_audio function in classes/engines/chatml.php. An authenticated attacker can supply an arbitrary URL to this function, causing the server to issue HTTP requests to internal or external resources on the attacker's behalf. The attack vector is network-based, requires low privileges (Subscriber role), no user interaction, and has a changed scope, meaning it can affect resources beyond the vulnerable component itself. The vulnerable code path is visible in the plugin's source repository (WordPress Trac, Wordfence).

Successful exploitation allows an attacker to pivot the web server into probing internal network services, potentially exposing sensitive internal infrastructure such as cloud metadata endpoints, internal APIs, or databases not directly accessible from the internet. The vulnerability carries low confidentiality and low integrity impact — an attacker may read or modify data from internal services reachable by the server. Availability is not directly impacted. The risk is amplified in cloud-hosted environments where instance metadata services (e.g., AWS IMDSv1) may be accessible (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the AI Engine plugin (versions ≤ 3.3.2) with "Public API" enabled. This can be done via passive fingerprinting or by checking plugin metadata endpoints.
2. Account acquisition: Obtain or register a Subscriber-level (or higher) WordPress account on the target site.
3. Confirm server configuration: Verify that allow_url_fopen is enabled on the target server, which is required for the SSRF to function.
4. Craft malicious request: Authenticate to the WordPress site and send a crafted request to the endpoint invoking the get_audio function, supplying an attacker-controlled or internal URL as the audio source parameter (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata).
5. Retrieve response: The server fetches the specified URL and may return or process the response, allowing the attacker to enumerate internal services, read metadata, or interact with internal APIs (Wordfence, WordPress Trac).

• Network: Outbound HTTP/HTTPS requests from the WordPress server to internal IP ranges (e.g., 169.254.169.254, 10.x.x.x, 192.168.x.x) or unexpected external hosts, originating from the web server process.
• Logs: WordPress or web server access logs showing authenticated POST/GET requests to AI Engine plugin endpoints (e.g., paths invoking get_audio) with unusual or internal URLs as parameters.
• Logs: PHP error logs or server logs showing allow_url_fopen-triggered outbound connections to non-standard destinations.
• Process: Web server process (e.g., php-fpm, apache2) initiating unexpected outbound TCP connections to internal network addresses or cloud metadata services.

Users should update the AI Engine plugin to version 3.3.3 or later, which addresses this vulnerability via a patch in classes/engines/chatml.php (WordPress Trac). As an interim workaround, administrators can disable the "Public API" option in the plugin settings, which removes one of the required preconditions for exploitation. Additionally, setting allow_url_fopen = Off in php.ini will prevent the SSRF from functioning, though this may impact other plugin features. Network-level controls such as egress filtering to block server-initiated requests to internal IP ranges are also recommended as a defense-in-depth measure.

Wordfence, which assigned and disclosed this CVE, included it in their weekly WordPress vulnerability report for the period of January 26 – February 1, 2026 (Wordfence Weekly Report). No significant broader media coverage or notable researcher commentary beyond standard vulnerability aggregator reporting has been identified for this CVE.