Summary
A missing authorization vulnerability exists in the AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin. This flaw allows unauthenticated attackers to gain administrator-level control. The vulnerability affects versions up to and including 3.8.6. A patch is available in version 3.8.7 and later. There is no evidence of active exploitation at this time.
Affected and patched versions
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini (plugin ai-engine): affected 3.8.6 and earlier; fixed in 3.8.7
Is my site vulnerable?
To determine if your WordPress site uses the affected plugin, check your installed plugins list. Navigate to the "Plugins" section within your WordPress administration dashboard. Look for "AI Engine – The Chatbot, AI Framework & MCP for WordPress, with Claude, ChatGPT & Gemini".
Once you locate the plugin, examine the version number displayed next to its name. If the installed version is 3.8.6 or earlier, your site is exposed to this vulnerability. For example, if you see "Version 3.8.5" or "Version 3.8.6", your site is vulnerable. If you see "Version 3.8.7" or a higher number, the vulnerability is resolved.
It is important to verify the exact version number. WordPress provides this information directly in the plugin management interface. Ensure you are logged in as an administrator to access this section. Regularly reviewing plugin versions helps maintain site security.
What an attacker actually does
This vulnerability stems from a missing authorization check within the MCP module of the AI Engine plugin. Specifically, the OAuth 2.1 Dynamic Client Registration endpoint, located at /wp-json/mcp/v1/oauth/register, is configured with a permission_callback of __return_true. This configuration means the endpoint does not properly verify user permissions before allowing an action.
Because of this missing authorization, an unauthenticated attacker can register an active OAuth client. During this registration process, the attacker can specify a redirect URI that they control. This step is crucial for the attacker to receive sensitive information later in the attack chain. The ability to register an OAuth client without authentication is the initial point of compromise.
After registering their malicious OAuth client, the attacker needs an administrator to approve this client. Once an administrator approves the attacker's client on the OAuth consent screen, the attacker can obtain an administrator-bound MCP access token. This token grants the attacker full administrator-level control through the MCP tools. This control includes the ability to create new user accounts and modify site options, among other administrative functions.
The consent page, which an administrator would interact with to approve the client, lacks important security headers. It is served without X-Frame-Options or Content-Security-Policy frame-ancestors. This absence allows for clickjacking attacks. In a clickjacking scenario, an attacker can embed the consent page within an invisible iframe on a malicious website. When an administrator visits the attacker's site and clicks what appears to be a harmless button or link, they might unknowingly be clicking the hidden consent button on the embedded page, thereby approving the attacker's OAuth client.
Successful exploitation of this vulnerability requires a privileged user, such as an administrator, to perform an action. This action could involve clicking a malicious link, visiting a specially crafted web page, or submitting a form. The combination of the missing authorization, the ability to register a controlled OAuth client, and the potential for clickjacking on the consent screen creates a path for unauthenticated attackers to gain administrative access.
How to detect a compromise
Detecting a compromise related to this vulnerability involves looking for specific indicators that suggest unauthorized administrative activity. Since an attacker can gain full administrator-level control, including user creation and option updates, these are key areas to examine.
Review your WordPress user list for any unfamiliar or newly created administrator accounts. Attackers often create new accounts to maintain persistent access. Check the user roles and ensure all administrator accounts are legitimate and recognized.
Examine your WordPress site's configuration settings for any unauthorized changes. This includes reviewing general settings, writing settings, reading settings, and any plugin-specific options that may have been altered. Unexpected changes to these settings could indicate a compromise.
While the plugin itself may not log specific OAuth client registrations in an easily accessible manner, monitoring general WordPress activity logs, if enabled, can sometimes reveal unusual administrative actions. Look for entries indicating new user registrations or significant option changes that you or your legitimate administrators did not initiate.
How to fix
To resolve this vulnerability, update the AI Engine – The Chatbot, AI Framework & MCP for WordPress, with Claude, ChatGPT & Gemini plugin to version 3.8.7 or later.
Log in to your WordPress administration dashboard.
Navigate to the "Plugins" section.
Locate "AI Engine – The Chatbot, AI Framework & MCP for WordPress, with Claude, ChatGPT & Gemini" in your list of installed plugins.
If an update is available, a notification will appear below the plugin name. Click "Update Now".
Confirm that the plugin has been updated to version 3.8.7 or a higher version number.
Applying this update addresses the underlying missing authorization vulnerability and secures the OAuth 2.1 Dynamic Client Registration endpoint.
Timeline
Date | Event |
|---|---|
2026-10-29 | Advisory published |
2026-10-29 | Information published |
2026-10-30 | CVE published |