Ai Engine CVE-2025-5071

This vulnerability presents HIGH real-world risk across multiple dimensions: (1) CVSS 8.8 indicates high severity with network-based attack vector (AV:N), low complexity (AC:L), and low privilege requirements (PR:L), enabling widespread exploitation; (2) The PR:L rating is critical—it requires only subscriber-level access, the lowest user tier in WordPress, making exploitation trivial on sites with user registration enabled; (3) The impact is comprehensive (C:H/I:H/A:H), affecting confidentiality, integrity, and availability through user escalation, data modification, and deletion; (4) Automatable exploitation is high—no user interaction required (UI:N) and no special network conditions (S:U); (5) Organizations with public registration or community sites face immediate risk; (6) The vulnerability enables cascading attacks: privilege escalation to admin, followed by plugin installation, backdoor deployment, or site defacement. While no active KEV/CISA listing or public POC is noted in the provided data, the straightforward nature of the flaw (missing authorization check) makes exploitation trivial once discovered, suggesting high EPSS probability. Priority: CRITICAL for sites with user registration; HIGH for private/restricted-access sites.

An attacker with a free account on a WordPress site using AI Engine 2.8.0–2.8.3 (subscriber-level access, the default for self-registered users) navigates to or discovers the MCP endpoint. Without authentication barriers, the attacker invokes the 'wp_create_user' command via the MCP interface to create a new administrator account with full site privileges. The missing capability check in 'can_access_mcp' allows this subscriber-level request to execute. Once elevated to admin, the attacker installs a malicious plugin, modifies site content via 'wp_update_post', or deploys a backdoor. Alternatively, the attacker uses 'wp_delete_post' to remove critical business pages, 'wp_update_option' to disable security plugins, or 'wp_delete_comment' to cover tracks. No user interaction is required, and the attack is fully automated. On a site with public registration, exploitation is possible within minutes of account creation.