Threats tagged 'ghsa-xfc5-7gqh-v42g'

The AI Engine WordPress plugin (up to version 3.8.4) contains a vulnerability in its upload_file function that allows authenticated users with subscriber-level access or higher to delete arbitrary media files. Exploitation requires the Public API option to be enabled by an administrator and depends on a scheduled cleanup task running after a malicious upload. This vulnerability is due to insufficient file path validation.