The AI Engine plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in the simpleTranscribeAudio endpoint. This endpoint fails to validate URL schemes before invoking get_audio(), which can be exploited by authenticated users with Subscriber-level privileges or higher to read arbitrary files on the web server. The exposed data can then be exfiltrated through the plugin’s OpenAI API integration. This vulnerability affects all versions up to and including 2.9.4. No known exploits are reported in the wild, and no patch or remediation guidance has been provided by the vendor yet.

An attacker with at least Subscriber-level access can exploit this vulnerability to read any file on the web server, potentially exposing sensitive information. The confidentiality of data is compromised, but integrity and availability are not affected. This could lead to unauthorized disclosure of sensitive files stored on the server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to the AI Engine plugin. Avoid exposing sensitive files on the web server that could be read if exploited.