Unauthenticated attackers can register a malicious OAuth client with the AI Engine plugin due to a missing authorization check. This allows them to obtain…
Affected component: AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini (plugin)
Fixed in: 3.8.7
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since October 31, 2026. No PowerSEC firewall rule blocks this attack. Update to 3.8.7 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-110732