"Flaw in AI Plugin Exposes 50,000 WordPress Sites to Remote Attack"

Security researchers at Patchstack discovered a critical vulnerability in the AI Engine plugin for WordPress, specifically affecting its free version with over 50,000 active installations.  The plugin is widely recognized for its diverse AI-related functionalities, allowing users to create chatbots, manage content, and utilize various AI tools such as translation, SEO, and more.  The researchers noted that the security flaw is an unauthenticated arbitrary file upload vulnerability in the plugin’s rest_upload function within the files.php module.  The vulnerability permits any unauthenticated user to upload arbitrary files, including potentially malicious PHP files, which could lead to remote code execution on the affected system.  The researchers noted that the lack of proper file type and extension validation in the code allows for the upload of arbitrary files, posing a significant security risk.  The plugin’s development team introduced a patch in version 1.9.99 to mitigate this vulnerability.  The patch implements a permission check on the custom REST API endpoint and incorporates file type and extension checks using the wp_check_filetype_and_ext function.  Users are strongly advised to download the latest version to protect their systems against potential exploitation.  The identifier CVE-2023-51409 has been assigned to track the issue.

Infosecurity Magazine reports: "Flaw in AI Plugin Exposes 50,000 WordPress Sites to Remote Attack"