All vulnerabilities
CWE-295
Medium
Improper TLS certificate verification in AI Engine
| Vendor | Meow Apps |
|---|---|
| Product | AI Engine |
| Affected versions | < 3.6.5 |
| Weakness | CWE-295 |
| Reported | 2026-07-28 |
| Disclosed | 2026-07-28 |
| Status | Vendor fixed |
Discovered and responsibly disclosed a security vulnerability in the AI Engine WordPress plugin, which has 100,000+ active installations. The vulnerability was validated and fixed by the developer in version 3.6.5, with official acknowledgment in the project's changelog. The issue involved improper TLS/SSL certificate verification, which could enable Man-in-the-Middle (MITM) attacks under certain conditions.
Related disclosures
High
Simple Shopping Cart < 5.3.3 – Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient
Medium
Elementor < 4.3.5 – Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass
Low
Code Snippets < 3.10.0 – Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet
Low
The Events Calendar 6.15.16.1 – 6.17.4.1 – Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes
View all