This is a path traversal in the WordPress AI Engine plugin (CVE-2026-16955, CVSS 5) with an architectural twist that complicates detection and expands the blast radius beyond what the score suggests. The vulnerability allows a subscriber-level user to read arbitrary files on the server. But because the plugin forwards content to external AI services as its core function, the read data can be silently exfiltrated to a remote endpoint. An attacker doesn't need to establish their own C2 channel — the plugin's authorized behavior becomes the relay.
The practical detection problem: outbound traffic from this plugin to its configured AI service is expected behavior. Security tools monitoring for anomalous file access or unusual egress will likely see only legitimate plugin operations. You're not looking for strange outbound connections — you're looking for file reads triggered by low-privilege users, which gets lost in the noise of normal plugin activity.
In WordPress multisite deployments, the risk amplifies significantly. A subsite administrator who exploits this to read wp-config obtains network-level authentication keys that unlock every subsite in the installation. That's not lateral movement within one site — it's simultaneous compromise across the entire network. This path requires no non-default configuration, making it the more realistic attack vector in production multisite environments.
The auto-forwarding behavior creates a compounding temporal risk. Unpatched instances aren't just vulnerable — they're actively transmitting potentially sensitive file contents to external AI services right now. Check your AI service logs for unexpected file content in requests, particularly wp-config.php, database credentials, or other configuration files. The window between disclosure and remediation is where actual exposure occurs.