The AI Engine WordPress plugin before version 3.7.9 has a vulnerability allowing users with the Editor role or above to modify or change the type of arbitrary posts on the site, including content they are not permitted to edit. This issue arises from the plugin's failure to verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object.
The AI Engine WordPress plugin before version 3.7.9 has a vulnerability that allows users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete. This is because the plugin does not check if the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it.
