The AI Engine WordPress plugin versions prior to 3.6.4 contain an authorization bypass vulnerability (CWE-639) where the plugin does not verify that a user owns the chatbot files they attempt to delete. Instead, it authorizes deletion requests based only on a session cookie value supplied by the client. An attacker who can obtain a victim's session identifier and file reference can exploit this to delete files uploaded by the victim without authentication.

An attacker who acquires a victim's session identifier and file reference can delete the victim's uploaded chatbot files. This can result in loss of user data and potential disruption of chatbot functionality for the victim. There is no indication of further privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to session identifiers and file references to prevent unauthorized deletion. Monitor for updates from the plugin vendor regarding a security patch or update to address this authorization bypass.