The AI Engine plugin for WordPress contains a missing authorization vulnerability (CWE-862) in its rest_list and delete_files functions. These functions lack proper capability checks, enabling unauthenticated attackers to list and delete files uploaded by other users. This affects all versions up to 2.9.5. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker without authentication can enumerate and delete files uploaded by other users, potentially leading to unauthorized data disclosure and data loss. There is no indication of availability impact or known active exploitation. The vulnerability compromises confidentiality and integrity of user-uploaded files within the affected plugin environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the WordPress REST API endpoints related to the AI Engine plugin or disable the plugin if possible to prevent exploitation. Monitor official tigroumeow or WordPress security advisories for updates and apply patches promptly once released.