AI Engine Privilege Escalation Vulnerability in WordPress Plugin

A privilege escalation vulnerability has been identified in the AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin, specifically in version 3.4.9. The issue arises from inadequate enforcement of WordPress capabilities in the MCP OAuth bearer-token authorization process. This flaw allows any valid OAuth token to grant MCP access without verifying whether the user has administrator privileges. As a result, authenticated users with Subscriber or higher roles can access admin-level MCP tools and elevate their privileges to Administrator.

Impact

Exploitation of this vulnerability allows authenticated users (Subscribers and above) to escalate their privileges to Administrator, gaining access to all administrative tools and capabilities within WordPress.

Remediation

Users can update to version 3.5.0 or a newer patched version to address this vulnerability.