AI Engine WordPress CVE-2026-15988

The AI Engine plugin version 3.6.5 or earlier must be installed and active on the target WordPress site. A user with WordPress administrator role must be authenticated (logged-in session active) at the time of the attack. That administrator must be social-engineered into clicking an attacker-controlled link or visiting a page hosting a forged request - passive drive-by exploitation without any user interaction is not possible due to UI:R. WordPress's ?_method=POST method-override feature must be functional, which is default behavior in WordPress REST API implementations and requires no special configuration. The MCP OAuth lab feature (labs/mcp-oauth.php) must be present in the installed plugin version, which it is in all versions ≤ 3.6.5. Exploitation is limited by the social engineering requirement: the attacker cannot force the admin interaction and must rely on a convincing phishing or watering-hole scenario. No attacker account or prior authentication to the target site is required.

CVSS 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately reflects the attack profile: the attacker requires no existing WordPress account (PR:N), the attack is low-complexity once a phishing vector is chosen (AC:L), and the sole friction is convincing a logged-in administrator to click a link (UI:R). This social engineering barrier is meaningful but well within the capability of targeted attackers. EPSS data was not provided in the input, so exploitation probability cannot be quantified numerically. KEV status is not present, so active exploitation is not confirmed. The Wordfence report and Trac changeset confirm the vulnerability is patched in 3.6.6, suggesting responsible disclosure with a fix available. Real-world risk is elevated by the severity of the outcome - full administrator account creation grants complete site takeover - and by the broad user base of AI/chatbot plugins in the WordPress ecosystem. The ?_method=POST technique is an underappreciated WordPress-core feature that may not be on defenders' radar, making detection harder than a standard CSRF.

An attacker crafts a URL pointing to the vulnerable WordPress site's REST /users endpoint, appending ?_method=POST and pre-supplying new administrator credentials as query parameters or form fields. The URL is embedded in a phishing email, comment, or forum post targeting the site administrator. When the logged-in admin clicks the link, the browser submits the GET request with the admin's session cookies; WordPress core's method-override rewrites it as a POST, the missing nonce validation on reauth_for_authorize allows it to pass, and the REST endpoint creates a new administrator account with the attacker's chosen username and password. No public exploit code has been identified at time of analysis, but the technique is straightforward to implement given public description detail.