The AI Engine WordPress plugin prior to version 3.7.9 fails to validate that the user executing the update_media_metadata or approve_media actions is the owner or an authorized editor of the target post. The vulnerability is based on an improper authorization weakness (CWE-862). An attacker who is an authenticated user with Editor or higher privileges can exploit this flaw to alter the content or post type of any post on the site, regardless of whether they normally have edit permissions for that content.

Sites running the AI Engine plugin version 3.7.9 or earlier are affected. The vendor is listed as Unknown:AI Engine. All WordPress installations that rely on this plugin for media management may be compromised if an Editor or higher role is granted access.

The flaw can be exercised through normal plugin operations by any authenticated user holding an Editor role or higher, requiring no additional privilege escalation. The CVSS score of 4.9 indicates a moderate severity, while the EPSS score of less than 1% reflects a low probability of exploitation. The vulnerability is not included in the CISA KEV catalog. Because the attacker can modify post content or type, the principal risk is to the integrity and trustworthiness of published content.