CVE-2026-16953 is an authorization bypass vulnerability in the AI Engine WordPress plugin prior to version 3.6.4. The flaw arises from the plugin's failure to verify that a guest user owns the chatbot files they attempt to delete. Instead, the plugin authorizes file deletion based only on a session cookie value supplied by the client. An attacker who obtains a victim's session identifier and file reference can exploit this to delete the victim's uploaded files without authentication.

The vulnerability allows an unauthenticated attacker to delete chatbot files uploaded by other users if the attacker can obtain the victim's session identifier and file reference. This results in integrity and availability impacts limited to the victim's uploaded files. There is no confidentiality impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to session identifiers and file references to prevent unauthorized deletion. Monitor for updates from the AI Engine plugin vendor regarding patches or official mitigations.