CVE-2026-110732 (GCVE-0-2026-110732)
Vulnerability from cvelistv5
Published
2026-10-30 06:47
Modified
2026-10-30 18:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/v1/oauth/register) being registered with a permission_callback of __return_true, allowing an unauthenticated user to register an active OAuth client with an attacker-controlled redirect URI. This makes it possible for unauthenticated attackers to obtain an administrator-bound MCP access token, and thereby full administrator-level control through the MCP tools (including user creation and option updates), once an administrator approves the attacker's client on the OAuth consent screen. The consent page is additionally served without X-Frame-Options or Content-Security-Policy frame-ancestors, so that approval can be obtained via clickjacking.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| tigroumeow | AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini |
Version: 0 ≤ 3.8.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110732",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:32:36.478386Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T18:09:00.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AI Engine \u2013 MCP Server \u0026 AI Chatbot for WordPress, with Claude, ChatGPT \u0026 Gemini",
"vendor": "tigroumeow",
"versions": [
{
"lessThanOrEqual": "3.8.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "satoshigpt2021-sketch"
}
],
"descriptions": [
{
"lang": "en",
"value": "The AI Engine \u2013 The Chatbot, AI Framework \u0026 MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module\u0027s OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/v1/oauth/register) being registered with a permission_callback of __return_true, allowing an unauthenticated user to register an active OAuth client with an attacker-controlled redirect URI. This makes it possible for unauthenticated attackers to obtain an administrator-bound MCP access token, and thereby full administrator-level control through the MCP tools (including user creation and option updates), once an administrator approves the attacker\u0027s client on the OAuth consent screen. The consent page is additionally served without X-Frame-Options or Content-Security-Policy frame-ancestors, so that approval can be obtained via clickjacking."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T06:47:32.210Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb115a8a-35f8-426f-bb67-4a523f67cb34?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/labs/mcp-oauth.php#L1159"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/labs/mcp-oauth.php#L496"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/labs/mcp-oauth.php#L317"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/labs/mcp-oauth.php#L609"
},
{
"url": "https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/labs/mcp.php#L232"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3760852%40ai-engine%2Ftags%2F3.8.7\u0026old=3757660%40ai-engine%2Ftags%2F3.8.6"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3760851/ai-engine/trunk/labs/mcp-oauth.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-14T15:37:28.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-29T18:00:34.000Z",
"value": "Disclosed"
}
],
"title": "AI Engine \u2013 The Chatbot, AI Framework \u0026 MCP for WordPress \u003c= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-110732",
"datePublished": "2026-10-30T06:47:32.210Z",
"dateReserved": "2026-10-14T15:22:06.871Z",
"dateUpdated": "2026-10-30T18:09:00.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-110732\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-30T17:32:36.478386Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-30T18:02:07.805Z\"}}], \"cna\": {\"title\": \"AI Engine \\u2013 The Chatbot, AI Framework \u0026 MCP for WordPress \u003c= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"satoshigpt2021-sketch\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"tigroumeow\", \"product\": \"AI Engine \\u2013 MCP Server \u0026 AI Chatbot for WordPress, with Claude, ChatGPT \u0026 Gemini\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.8.6\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-10-14T15:37:28.000Z\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2026-10-29T18:00:34.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb115a8a-35f8-426f-bb67-4a523f67cb34?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/labs/mcp-oauth.php#L1159\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/labs/mcp-oauth.php#L496\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/labs/mcp-oauth.php#L317\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/labs/mcp-oauth.php#L609\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.3/labs/mcp.php#L232\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3760852%40ai-engine%2Ftags%2F3.8.7\u0026old=3757660%40ai-engine%2Ftags%2F3.8.6\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset/3760851/ai-engine/trunk/labs/mcp-oauth.php\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The AI Engine \\u2013 The Chatbot, AI Framework \u0026 MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module\u0027s OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/v1/oauth/register) being registered with a permission_callback of __return_true, allowing an unauthenticated user to register an active OAuth client with an attacker-controlled redirect URI. This makes it possible for unauthenticated attackers to obtain an administrator-bound MCP access token, and thereby full administrator-level control through the MCP tools (including user creation and option updates), once an administrator approves the attacker\u0027s client on the OAuth consent screen. The consent page is additionally served without X-Frame-Options or Content-Security-Policy frame-ancestors, so that approval can be obtained via clickjacking.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862 Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-10-30T06:47:32.210Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-110732\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-30T18:09:00.341Z\", \"dateReserved\": \"2026-10-14T15:22:06.871Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-10-30T06:47:32.210Z\", \"assignerShortName\": \"Wordfence\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…