The AI Engine plugin suffers from a lack of file type validation, allowing attackers to upload files that the system may handle as executable content. This flaw is classified as CWE‑434, and could let a malicious user place files that the WordPress installation might later execute or expose. Because the server may treat such uploads as downloadable or processor‑ready media, the attacker could potentially gain code execution, unauthorized data access, or disrupt site availability.

The vulnerability applies to Jordy Meow AI Engine plugin versions up to 3.3.2. Any WordPress site running one of these versions of the plugin is at risk. The flaw exists in all installations regardless of theme or other plugins.

The rating for this vulnerability is 9.1 out of 10, categorizing it as critical. The exploitation probability is less than 1% according to current risk models, and the issue is not listed in the CISA KEV catalog. The likely attack vector is via the plugin’s upload endpoint, where an attacker can supply a file that bypasses type checks. If successful, such a file could be processed or executed by the web server, making this a high‑impact risk for sites that use the affected plugin.