8.8
Élevée
CVE-2026-8719 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation…
Description
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any valid OAuth token causes MCP access to be granted without verifying administrator privileges. This makes it possible for authenticated (Subscriber+) attackers to invoke admin-level MCP tools and escalate privileges to Administrator.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| AI Engine – The Chatbot, AI Framework & MCP for WordPress | 3.4.9 | Pas de correctif indiqué |
Autres CVE de AI Engine – The Chatbot, AI Framework & MCP for WordPress
Les 14 CVE de AI Engine – The Chatbot, AI Framework & MCP for WordPress →
CVE-2026-96561
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site…
7.2
Élevée
CVE-2026-89141
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct…
6.5
Moyenne
CVE-2026-15988
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request…
8.8
Élevée
CVE-2026-1400
The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file…
7.2
Élevée