AI Engine EUVD-2026-113739

The MCP module and its OAuth 2.1 server must be active on the target (an opt-in 'labs' capability of AI Engine), exposing /wp-json/mcp/v1/oauth/register, which anyone can hit because its permission_callback is __return_true. The decisive limiting factor is that unauthenticated registration alone yields nothing - a WordPress administrator must approve the attacker's registered client on the OAuth consent screen before an administrator-bound MCP token is issued. The required administrator interaction (UI:R) is the real gate; exploitation realistically depends on social engineering, made materially easier by the consent page lacking X-Frame-Options and CSP frame-ancestors, enabling clickjacking of that approval. Applies to all versions ≤ 3.8.6; fixed in 3.8.7.

This is a genuine, high-severity authorization flaw (CVSS 7.5, CVSS:3.1/AV:N/AC:H/PR:N/UI:R) but not a drop-everything emergency. The signals are internally consistent: the OAuth Dynamic Client Registration endpoint is reachable unauthenticated (PR:N), yet full administrator compromise is gated on an administrator actually approving the attacker's rogue client on the consent screen - which is exactly why the vector carries AC:H and UI:R rather than a fully automatable 9.8. The description grounds this complexity concretely: approval must be socially engineered, made easier by clickjacking because the consent page ships without X-Frame-Options or CSP frame-ancestors. No EPSS probability was provided in the input, there is no CISA KEV listing, and no working exploit reference is present - only the Wordfence advisory, plugin source lines, and the fix changeset. The vuln.today decision label is 'this_week', which aligns with a serious-but-interaction-dependent issue rather than mass automated exploitation. Missing/absent signals to note explicitly: EPSS score not supplied, KEV status not supplied (treated as not listed), and no public PoC identified - so real-world exploitation prevalence cannot be quantified from this data.

An unauthenticated attacker calls /wp-json/mcp/v1/oauth/register to silently register an active OAuth client pointing at their own redirect URI, then lures a logged-in administrator to a page that frames or overlays the MCP OAuth consent screen (possible because it lacks frame-ancestor protections) and tricks them into clicking Approve. Once approved, the attacker receives an administrator-bound MCP access token and drives the MCP tools to create admin users and change site options. No public exploit code was identified at time of analysis.