CVE-2026-110976

{
  "etk_id": "ETK-2026-1994",
  "cve_id": "CVE-2026-110976",
  "display_id": "CVE-2026-110976",
  "ghsa_id": "GHSA-8w27-j698-c24m",
  "euvd_id": "EUVD-2026-103398",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper authorization in AI Engine WordPress plugin",
  "summary": "AI Engine WordPress plugin versions before 3.7.9 inadequately authorize ownership checks for certain media actions. An authenticated user with the Editor role or greater can delete posts and other site content that their normal permissions would not allow them to remove.",
  "mitigation": "Upgrade the AI Engine WordPress plugin to version 3.7.9 or later. Restrict Editor-level access until the update is installed.",
  "vendor": null,
  "product": "AI Engine",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 3.7.9"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.7.9"
      ],
      "package_name": "AI Engine",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 4.9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
  "epss_score": 0.0019,
  "epss_percentile": 0.0845,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 37.18608691666667,
  "t0_at": "2026-10-18T06:00:16.527000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-18T17:46:43.526144+00:00",
      "days": 0.49059026787037036,
      "is_lower_bound": false,
      "measured_at": "2026-10-18T06:00:16.527000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-18T06:00:16.527000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-18T06:00:16.527000+00:00",
      "url": "https://github.com/advisories/GHSA-8w27-j698-c24m"
    }
  }
}