CVE-2026-8719

High

Published: 17/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin version 3.4.9 is vulnerable to privilege escalation. This is due to missing WordPress capability enforcement in the OAuth bearer-token authorization path, allowing access to admin-level MCP tools without verifying administrator privileges.

Risk Assessment

Authenticated attackers (Subscriber+) can invoke admin-level tools, posing a significant security risk to the WordPress system.

Recommendation

It is recommended to update the plugin to the latest version to mitigate this vulnerability and implement additional security measures to restrict access to MCP tools.

Original NVD description (English source)

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any valid OAuth token causes MCP access to be granted without verifying administrator privileges. This makes it possible for authenticated (Subscriber+) attackers to invoke admin-level MCP tools and escalate privileges to Administrator.