Read the docs
TI-2026-82953 Aliases CVE-2026-110732GHSA-22w7-p44p-2gq7

Missing authorization in AI Engine plugin allows admin account takeover

Priority LOW 35CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

All versions of the AI Engine WordPress plugin by tigroumeow through 3.8.6 are affected. Missing authorization (CWE-862) in the MCP OAuth client registration endpoint lets unauthenticated users register clients with attacker-controlled redirect URIs. An attacker can obtain an administrator-bound access token and control the site through MCP tools once an administrator approves the client, and the consent page can be clickjacked to obtain that approval.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/v1/oauth/register) being registered with a permission_callback of __return_true, allowing an unauthenticated user to register an active OAuth client with an attacker-controlled redirect URI. This makes it possible for unauthenticated attackers to obtain an administrator-bound MCP access token, and thereby full administrator-level control through the MCP tools (including user creation and option updates), once an administrator approves the attacker's client on the OAuth consent screen. The consent page is additionally served without X-Frame-Options or Content-Security-Policy frame-ancestors, so that approval can be obtained via clickjacking.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00273 19th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tigroumeowAI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Geminiup to 3.8.6—No fix listedCNA
  • AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini Vendortigroumeow Affected up to 3.8.6 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for AI Engine (MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini).

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-110732
  2. 2026-10-30 Alias added: GHSA-22w7-p44p-2gq7
  3. 2026-10-30 CISA SSVC decision points changed
  4. 2026-10-30 Priority changed: MEDIUM → LOW

References

Other 8

  • TI-2025-10772 AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation CVSS 3.1CRITICAL 9.8
  • TI-2023-28063 WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2024-09725 AI-Engine < 2.6.5 - Admin+ SQLi CVSS 3.1HIGH 7.2
  • TI-2024-05988 AI Engine < 2.5.1 - Admin+ RCE CVSS 3.1HIGH 7.2
  • TI-2024-19264 WordPress AI Engine plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability CVSS 3.1MEDIUM 6.8
  • TI-2024-06230 AI Engine < 2.4.8 - Admin+ SQLi CVSS 3.1MEDIUM 4.7
See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences