CVE-2024-0699 is a medium severity arbitrary file upload in the AI Engine plugin for WordPress, scored 6.6, in all versions up to and including 2.1.4. It needs Editor access or higher. Update the plugin to the latest release, since the record's changeset points to a fix in its core class.
What's affected
The record says the AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is affected in all versions up to and including 2.1.4. I could not retrieve the vendor changeset or advisory pages, so a fixed version is not confirmed here. The record says all versions up to and including 2.1.4 are affected, which implies a later release carries the fix. Check the plugin changelog on WordPress.org and the Wordfence entry before you rely on a specific number.
The vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. High privileges are required and complexity is high, but if both conditions are met the impact is high on all three properties. The record notes that CVE-2024-29100 is likely a duplicate of this issue. The weakness class is CWE-434.
How to check if you're exposed
If you have WP-CLI access, list installed plugins and their versions:
wp plugin list --fields=name,version,status,update
Look for the ai-engine row. If the version is 2.1.4 or lower, you are in the affected range. You can also open Plugins in the WordPress admin and read the version under the plugin name.
To update from the command line:
wp plugin update ai-engine
Deactivated plugins still sit on disk and in some cases can still be reached by URL, so check inactive ones too.
What to do now
- Check the installed version of the plugin on every WordPress site you run, including staging copies.
- Update to the latest release and confirm in the changelog that the issue is addressed.
- If you cannot update right away, deactivate the plugin until you can, or restrict access with your web application firewall.
- Review access logs and the database for unexpected activity if the site was exposed for a long period.
- Add the plugin to the list you watch for new advisories.
Why it matters
The add_image_from_url function does not validate the type of file it saves. The record says an authenticated attacker with Editor access or above could upload arbitrary files to the server, which may make remote code execution possible.
The Editor requirement lowers the odds, but it does not remove the risk. Editor accounts are often shared with contractors, and credentials leak. A single compromised Editor login turns this into a path to a web shell. File type validation belongs on the server side, with an allowlist of extensions and content types, and uploads should land where the web server will not execute them.
The record does not mark this CVE as known exploited, and no advisory I fetched says it is. Plugin flaws like this are still scanned for in bulk once they are public, so patch windows matter more than the exact score.
If the affected component is something your own code pulls in as a dependency, the free in-browser dependency scan at gold.safeguard.sh/scan will tell you whether it appears in your manifests. Reachability analysis then helps you separate the copies that your code actually exercises from the ones that only sit in the tree.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this exploitable by anonymous visitors?
No. The record says Editor access or above is required.
What is CVE-2024-29100?
The record says it is likely a duplicate of this issue.
Sources
Last reviewed: 19 October 2026.
