The AI Engine WordPress plugin before version 3.7.9 fails to verify that the media item being processed belongs to the user who initiates the action. This omission allows any user with Editor privileges or higher to request the deletion of arbitrary posts, regardless of ownership. An attacker can therefore permanently remove posts of any type, including critical content such as navigation menus, block templates, and global styles, effectively breaking site navigation and design.

All installations of the AI Engine WordPress plugin with a version earlier than 3.7.9 are susceptible. The vulnerability is present in the plugin's reject_media action, which is available to users assigned the Editor role or higher. No specific vendor updates are listed, but the plugin is identified as Unknown:AI Engine.

The risk of exploitation is moderate because the CVSS score is 4.9. The vulnerability can be triggered by any authenticated user with the Editor role or above, a role commonly assigned to content editors. Attackers can execute the deletion without advanced technical skills, as the action does not require elevated privileges beyond those granted to an Editor. With the EPSS score unavailable and the vulnerability not listed in KEV, the potential for permanent content loss and the absence of a hardening safeguard make this flaw particularly concerning in environments where Editors have widespread authority.