CVE-2026-75797: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in AI Engine

The AI Engine WordPress plugin versions before 3.7.2 do not properly restrict pathname resolution when mapping a caller-supplied URL to a local filesystem path. This improper limitation allows users with subscriber-level privileges to read arbitrary files from the server and exfiltrate their contents, contingent on a non-default public API feature being enabled. If this feature is not enabled, the vulnerability can still be exploited by administrators, which on multisite installations permits non-super subsite administrators to access shared network configuration and secrets. This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Successful exploitation allows unauthorized reading of arbitrary files on the server, potentially exposing sensitive configuration data and secrets. Subscriber-level users can exploit this if a specific public API feature is enabled, while administrators can exploit it regardless, increasing the risk on multisite WordPress installations. The vulnerability does not affect integrity or availability but has a high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the non-default public API feature to reduce exposure for subscriber-level users. Administrators should review permissions and consider restricting access to the plugin or multisite configuration to trusted users only.