CVE-2024-0699

The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_image_from_url' function in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Editor access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2024-29100 is likely a duplicate of this issue.

• CWE-434
• CWE-434
• CWE-434

• https://plugins.trac.wordpress.org/changeset/3021494/ai-engine/trunk/classes/core.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0a86f6ed-9755-4265-bc0d-2d0e18e9982f?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset/3021494/ai-engine/trunk/classes/core.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0a86f6ed-9755-4265-bc0d-2d0e18e9982f?source=cveThird Party Advisory

Published

Feb 5, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0693A vulnerability classified as problematic was found in EFS E…7.5
• CVE-2024-0694Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-0695A vulnerability, which was classified as problematic, has be…5.3
• CVE-2024-0696A vulnerability, which was classified as problematic, was fo…6.1
• CVE-2024-0697The Backuply – Backup, Restore, Migrate and Clone plugin for…4.9
• CVE-2024-0698The Easy!Appointments plugin for WordPress is vulnerable to …5.4
• CVE-2024-0700The Simple Tweet plugin for WordPress is vulnerable to Store…5.4
• CVE-2024-0701The UserPro plugin for WordPress is vulnerable to Security F…5.3
• CVE-2024-0702The Oliver POS – A WooCommerce Point of Sale (POS) plugin fo…7.3
• CVE-2024-0703The Sticky Buttons – floating buttons builder plugin for Wor…4.8
• CVE-2024-0704Rejected reason: very low impact - impractical to correct
• CVE-2024-0705The Stripe Payment Plugin for WooCommerce plugin for WordPre…7.5