CVE-2026-110732: AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/v1/oauth/register) being registered with a permissioncallback of returntrue, allowing an unauthenticated user to register an active OAuth client with an attacker-controlled redirect URI. This makes it possible for unauthenticated attackers to obtain an administrator-bound MCP access token, and thereby full administrator-level control through the MCP tools (including user creation and option updates), once an administrator approves the attacker's client on the OAuth consent screen. The consent page is additionally served without X-Frame-Options or Content-Security-Policy frame-ancestors, so that approval can be obtained via clickjacking.
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites running the AI Engine plugin in any version up to and including 3.8.6 are affected if the MCP module and its OAuth registration endpoint are available. An attacker does not need an existing WordPress account.
What must an attacker do to gain administrator-level control?
The attacker can register an OAuth client with an attacker-controlled redirect URI, but must still cause an administrator to approve that client on the OAuth consent screen. The missing anti-framing protections on the consent page allow that approval step to be targeted through clickjacking.
What access does a successful attacker obtain?
After administrator approval, the attacker can obtain an administrator-bound MCP access token. This provides administrator-level control through MCP tools, including creating users and updating WordPress options.
How can defenders identify attempted exploitation?
Review activity involving requests to /wp-json/mcp/v1/oauth/register and look for newly registered OAuth clients with unexpected redirect URIs. Also investigate administrator OAuth consent approvals that cannot be tied to an expected MCP client or workflow.