CVE-2026-16955: 
WordPress vulnerability analysis and mitigation

CVE-2026-16955 is a path traversal (Local File Inclusion) vulnerability in the AI Engine WordPress plugin that allows unauthorized arbitrary file read and exfiltration. Affecting all versions before 3.6.6, the flaw enables subscriber-level users (when the non-default public API feature is enabled) or administrators to read arbitrary files from the server and forward their contents to an external service. On WordPress multisite installations, a non-super subsite administrator can exploit this to access network-shared configuration files and secrets. It carries a CVSS score of 7.7 (High) and was publicly disclosed on August 3, 2026, with a patch released on August 8, 2026 (WPScan, GitHub Advisory).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal) and is categorized under OWASP Top 10 A1: Injection (WPScan). The plugin's audio transcription feature accepts a caller-supplied file path without proper validation or confinement, then reads the file and forwards its contents to an external service — effectively enabling server-side file exfiltration. Exploitation at subscriber level requires the plugin's public API feature to be enabled (a non-default configuration); without it, the same code path is accessible to administrators. The original researcher is Revanth Hari Narayana Matte, and a proof-of-concept is scheduled for public release on August 17, 2026 (WPScan).

Successful exploitation allows an attacker to read arbitrary files from the web server's filesystem — including sensitive configuration files, credentials, API keys, and WordPress secrets — and exfiltrate them to an attacker-controlled external service. On WordPress multisite deployments, a non-super subsite administrator can access network-wide configuration and shared secrets, potentially enabling privilege escalation or lateral movement across the network. The primary impact is a confidentiality breach, with significant risk of credential theft and further compromise of connected services (WPScan, GitHub Advisory).

There is currently no public proof-of-concept exploit available; WPScan has indicated the PoC will be published on August 17, 2026, to allow time for patching (WPScan). No evidence of in-the-wild exploitation has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.00158 (low probability of near-term exploitation), reflecting the limited attack surface due to the non-default configuration requirement for subscriber-level exploitation (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the AI Engine plugin (slug: ai-engine) in versions prior to 3.6.6 using tools like WPScan or by checking the plugin's readme.txt file at https://target.com/wp-content/plugins/ai-engine/readme.txt.
2. Check public API status: Determine whether the plugin's public API feature is enabled (non-default). This can be inferred by probing the plugin's API endpoints for unauthenticated or subscriber-level access.
3. Authenticate as subscriber (if public API is enabled): Register or log in as a low-privileged subscriber-level WordPress user.
4. Craft malicious request: Submit a request to the plugin's audio transcription endpoint, supplying a crafted file path (e.g., ../../../../wp-config.php or /etc/passwd) as the file parameter instead of a legitimate audio file path.
5. Receive exfiltrated data: The plugin reads the specified file and forwards its contents to the configured external service (e.g., an AI transcription API). Monitor or intercept the outbound request to capture the file contents.
6. Escalate on multisite: If operating as a subsite administrator on a multisite installation, target network-shared configuration files to extract secrets applicable across the entire WordPress network (WPScan).

• Network: Unexpected outbound HTTP/HTTPS requests from the web server to external AI transcription or API services containing file contents (e.g., wp-config.php data, /etc/passwd entries); unusual POST requests to AI Engine plugin endpoints with file path parameters containing traversal sequences (../, ..\, or absolute paths).
• Logs: Web server access logs showing requests to AI Engine plugin endpoints (e.g., paths under /wp-json/ or /wp-admin/admin-ajax.php with AI Engine action parameters) with suspicious file or path parameter values; PHP error logs referencing unexpected file reads outside the web root.
• File System: No direct file system artifacts expected from read-only exploitation, but review of recently accessed files (via auditd or similar) may reveal unauthorized reads of sensitive files such as wp-config.php, .env, or system files like /etc/passwd.
• Process: PHP processes making outbound network connections to external AI service endpoints while reading files outside the WordPress installation directory (WPScan).

Update the AI Engine WordPress plugin to version 3.6.6 or later, which was released on August 8, 2026, and contains the fix for this vulnerability (WPScan, GitHub Advisory). If an immediate update is not possible, disable the plugin's public API feature in the plugin settings to prevent subscriber-level exploitation. On WordPress multisite installations, restrict subsite administrator privileges and audit access to network-shared configuration files. Monitor web server and PHP logs for suspicious file path parameters in requests to AI Engine endpoints.

The vulnerability was noted on Mastodon/Infosec.exchange by the offseq account shortly after disclosure, and was picked up by standard vulnerability aggregators including Vulners, VulDB, and CVEFeed (Feedly). No major vendor statements or significant researcher commentary beyond the original WPScan disclosure have been identified at this time.