CVE-2026-110732 in AI Engine Plugin
Summary
by MITRE • 10/30/2026
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/v1/oauth/register) being registered with a permission_callback of __return_true, allowing an unauthenticated user to register an active OAuth client with an attacker-controlled redirect URI. This makes it possible for unauthenticated attackers to obtain an administrator-bound MCP access token, and thereby full administrator-level control through the MCP tools (including user creation and option updates), once an administrator approves the attacker's client on the OAuth consent screen. The consent page is additionally served without X-Frame-Options or Content-Security-Policy frame-ancestors, so that approval can be obtained via clickjacking.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in the AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin affects all versions up to and including 3.8.6. This critical security flaw stems from a missing authorization check within the Model Context Protocol (MCP) module of the plugin. Specifically, the OAuth 2.1 Dynamic Client Registration endpoint located at /wp-json/mcp/v1/oauth/register is configured with a permission callback that unconditionally returns true. This configuration error effectively bypasses authentication requirements for this specific API route, allowing any user, including those who are not logged in or lack administrative privileges, to interact with the client registration mechanism without providing valid credentials.
The technical core of this vulnerability lies in the improper validation and authorization logic applied during the OAuth 2.1 dynamic client registration process. By setting the permission callback to __return_true, the plugin fails to verify whether the requester has the necessary permissions to register a new OAuth application. Consequently, an unauthenticated attacker can submit requests to create active OAuth clients with redirect URIs controlled by the attacker. This capability is particularly dangerous because it allows the adversary to manipulate the flow of authentication tokens. Once a client is registered, the attacker can initiate an authorization request that directs the user agent to their maliciously configured endpoint upon successful consent.
The operational impact of this vulnerability is severe, as it facilitates privilege escalation from unauthenticated access to full administrative control over the WordPress installation. The attack chain begins with the registration of a rogue OAuth client by the unauthenticated attacker. Following this, the attacker lures an administrator into interacting with the authorization endpoint. Due to additional security misconfigurations on the consent page—specifically the absence of X-Frame-Options and Content-Security-Policy frame-ancestors headers—the consent screen is vulnerable to clickjacking attacks. An attacker can embed the legitimate WordPress admin interface within a hidden iframe, tricking an administrator into clicking buttons that approve the registration without their explicit knowledge or intent.
Once the administrator approves the client through this manipulated consent screen, the OAuth flow completes successfully, issuing an access token bound to the administrator's role. This MCP access token grants the attacker full administrative privileges via the MCP tools exposed by the plugin. With these elevated permissions, the attacker can perform critical actions such as creating new user accounts with admin rights, modifying core site options, and potentially executing arbitrary code depending on how the MCP tools are implemented within the broader application context. This represents a complete compromise of the WordPress environment's integrity and confidentiality.
From an industry standards perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves failing to enforce proper authorization checks for sensitive operations. Furthermore, the use of clickjacking to obtain consent relates to CWE-1021 Improved Clickjacking, while the overall attack vector involving OAuth manipulation and token theft is consistent with MITRE ATT&CK techniques such as T1556 Phishing: Multi-Factor Authentication Interception or T1078 Valid Accounts. The lack of frame protection headers also corresponds to CWE-1024 Related to Clickjacking, highlighting a failure in implementing security policies for user interface integrity.
Mitigation strategies should focus on immediate remediation and long-term hardening. Administrators running affected versions must update the plugin to version 3.8.7 or later where this authorization flaw has been corrected. In addition to updating, it is crucial to ensure that all OAuth endpoints enforce strict authentication checks using WordPress capabilities such as current_user_can rather than returning true unconditionally. Security headers including X-Frame-Options set to DENY and Content-Security-Policy with frame-ancestors 'none' should be enforced on the consent page to prevent clickjacking attacks. Regular security audits of plugin code, particularly around authentication and authorization logic for API endpoints, are recommended to detect similar misconfigurations early in the development lifecycle.