Ai Engine The Chatbot Ai Framework Mcp For Wordpress
Monthly
Stored cross-site scripting in the AI Engine - The Chatbot, AI Framework & MCP for WordPress plugin (versions up to and including 3.8.0) lets an unauthenticated attacker plant script payloads that execute in a WordPress site's admin dashboard. The attack chains a denylist bypass on the /mwai-ui/v1/chats/submit REST endpoint into the plugin's own PHP error-log parser, which returns the forged log line as recent PHP-error content that the Advisor task then feeds verbatim into the AI prompt (CWE-1427 indirect prompt injection); the unvalidated AI response is saved to the mwai_advisor_data option and rendered by the Advisor dashboard widget without escaping. Exploitation is conditional - the Advisor task, its error-log ingestion, and the non-streaming/non-admin catch branch must all be in play, and the payload only fires when an authenticated administrator opens the dashboard and the Advisor widget renders - which is why the independent assessment scores it UI:R despite the PR:N injection path; no public exploit code has been identified at time of analysis and there is no CISA KEV listing.
Cross-Site Request Forgery in AI Engine plugin (all versions ≤ 3.6.5) enables unauthenticated attackers to create new WordPress administrator accounts by tricking a logged-in site admin into clicking a crafted link. The attack exploits missing nonce validation on the `reauth_for_authorize` function in `labs/mcp-oauth.php`, combined with WordPress's built-in `?_method=POST` method-override feature to convert an innocuous-looking GET navigation request into an authenticated POST to the REST `/users` endpoint - no attacker account required. No public exploit has been identified at time of analysis, but the attack primitive is straightforward and the impact (full site takeover) is severe.
Authenticated attackers can escalate privileges to Administrator in AI Engine WordPress plugin version 3.4.9 through improper authorization in the MCP OAuth bearer-token implementation. The plugin accepts any valid OAuth token for Model Context Protocol (MCP) access without verifying administrator privileges, allowing low-privileged users (Subscriber+) to execute admin-level MCP tools. No public exploit or active exploitation identified at time of analysis.
Insecure Direct Object Reference in the AI Engine WordPress plugin (tigroumeow, versions ≤3.7.7) allows authenticated subscribers to retrieve transcribed text from private audio attachments owned by any WordPress user, including site administrators. The `mediaId` REST API parameter accepts user-supplied attachment IDs without verifying the requester's ownership or access rights, enabling systematic enumeration of sequential WordPress attachment IDs. Exploitation is configuration-gated - the Public API module must be enabled - and no KEV listing or confirmed public exploit code exists at time of analysis.
Stored cross-site scripting in the AI Engine - The Chatbot, AI Framework & MCP for WordPress plugin (versions up to and including 3.8.0) lets an unauthenticated attacker plant script payloads that execute in a WordPress site's admin dashboard. The attack chains a denylist bypass on the /mwai-ui/v1/chats/submit REST endpoint into the plugin's own PHP error-log parser, which returns the forged log line as recent PHP-error content that the Advisor task then feeds verbatim into the AI prompt (CWE-1427 indirect prompt injection); the unvalidated AI response is saved to the mwai_advisor_data option and rendered by the Advisor dashboard widget without escaping. Exploitation is conditional - the Advisor task, its error-log ingestion, and the non-streaming/non-admin catch branch must all be in play, and the payload only fires when an authenticated administrator opens the dashboard and the Advisor widget renders - which is why the independent assessment scores it UI:R despite the PR:N injection path; no public exploit code has been identified at time of analysis and there is no CISA KEV listing.
Cross-Site Request Forgery in AI Engine plugin (all versions ≤ 3.6.5) enables unauthenticated attackers to create new WordPress administrator accounts by tricking a logged-in site admin into clicking a crafted link. The attack exploits missing nonce validation on the `reauth_for_authorize` function in `labs/mcp-oauth.php`, combined with WordPress's built-in `?_method=POST` method-override feature to convert an innocuous-looking GET navigation request into an authenticated POST to the REST `/users` endpoint - no attacker account required. No public exploit has been identified at time of analysis, but the attack primitive is straightforward and the impact (full site takeover) is severe.
Authenticated attackers can escalate privileges to Administrator in AI Engine WordPress plugin version 3.4.9 through improper authorization in the MCP OAuth bearer-token implementation. The plugin accepts any valid OAuth token for Model Context Protocol (MCP) access without verifying administrator privileges, allowing low-privileged users (Subscriber+) to execute admin-level MCP tools. No public exploit or active exploitation identified at time of analysis.
Insecure Direct Object Reference in the AI Engine WordPress plugin (tigroumeow, versions ≤3.7.7) allows authenticated subscribers to retrieve transcribed text from private audio attachments owned by any WordPress user, including site administrators. The `mediaId` REST API parameter accepts user-supplied attachment IDs without verifying the requester's ownership or access rights, enabling systematic enumeration of sequential WordPress attachment IDs. Exploitation is configuration-gated - the Public API module must be enabled - and no KEV listing or confirmed public exploit code exists at time of analysis.