A path traversal vulnerability in the AI Engine WordPress plugin allows authenticated users to read sensitive server files, posing a high risk of information disclosure.

This is a path traversal (CWE-22) vulnerability where the plugin fails to restrict file path mapping for user-supplied URLs. Any authenticated user with at least subscriber-level privileges can trigger this flaw if the non-default public API feature is enabled, while administrators can exploit it by default.

The ability to read arbitrary files from the server can lead to the exposure of sensitive configuration files, database credentials, and internal application secrets. Given the CVSS score of 7.7, this vulnerability represents a high-severity threat to confidentiality, potentially facilitating full system compromise or lateral movement within the hosting environment.

Immediate Action: Update the AI Engine plugin to version 3.7.2 or later to apply the necessary path validation fixes.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal sequences, such as dot-dot-slash patterns, directed toward the plugin's API endpoints.

Compensating Controls: Disable the public API feature within the AI Engine settings if it is not required for daily operations, and deploy a Web Application Firewall (WAF) to filter malicious URL parameters.

Public Exploit Available: No

Organizations utilizing the AI Engine plugin must prioritize updating to version 3.7.2 immediately. Because this vulnerability allows for the unauthorized reading of sensitive files, delaying the update significantly increases the exposure of critical environment secrets. If immediate patching is not feasible, administrators should verify the status of the public API feature and disable it as a temporary measure.