Skip to content
Sign in
8.8 High

CVE-2026-8719 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation…

Description

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any valid OAuth token causes MCP access to be granted without verifying administrator privileges. This makes it possible for authenticated (Subscriber+) attackers to invoke admin-level MCP tools and escalate privileges to Administrator.

Affected products and versions

Product Affected versions Fixed in
AI Engine – The Chatbot, AI Framework & MCP for WordPress 3.4.9 No fix stated

Other CVEs of AI Engine – The Chatbot, AI Framework & MCP for WordPress

The 14 CVEs of AI Engine – The Chatbot, AI Framework & MCP for WordPress →
CVE-2026-96561 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site… 7.2 High CVE-2026-89141 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct… 6.5 Medium CVE-2026-15988 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request… 8.8 High CVE-2026-1400 The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file… 7.2 High
Track this CVE