The AI Engine WordPress plugin versions earlier than 3.7.9 fails to verify authorization when handling certain media management actions. A user with the Editor role or higher can call the update_media_metadata and approve_media functions and alter any post on the site, even if the user is not normally allowed to edit that content. This flaw permits an attacker to modify or change the type of arbitrary posts, potentially compromising the integrity of published content and undermining trust. The weakness corresponds to improper access control violations (CWE-284).

The vulnerability affects sites that use the AI Engine plugin, version 3.7.8 or below, published by Unknown:AI Engine. Any WordPress user holding an Editor or higher role is capable of exploiting the flaw, regardless of the original ownership of the targeted post.

The plugin does not require an advanced attack vector; the flaw is exposed through normal plugin operations that any authenticated Editor or higher user can access. No exploit data is currently available (EPSS and KEV are not listed). The potential impact on confidentiality, integrity, and availability depends on the website’s content workflow, but the vulnerability allows direct post modification, a serious concern for media and content integrity.