{“lastseen”:””,”description”:”The AI Engine \u2013 The Chatbot, AI Framework \\u0026 MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any valid OAuth token causes MCP access to be granted without verifying administrator privileges. This makes it possible for authenticated (Subscriber+) attackers to invoke admin-level MCP tools and escalate privileges to Administrator.”,”published”:”2026-05-17T02:27:02.277Z”,”modified”:”2026-05-17T02:27:02.277Z”,”type”:”cve”,”title”:”AI Engine 3.4.9 – Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token”,”source”:”Wordfence”,”references”:”https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/0593c20d-3422-4817-9639-614254b609db?source=cve\\nhttps:\/\/plugins.trac.wordpress.org\/changeset\/3533527\/ai-engine”,”id”:”CVE-2026-8719″,”bulletinFamily”:””,”cwe”:[“CWE-269″],”cvelist”:null,”sourceData”:”tigroumeow AI Engine \u2013 The Chatbot, AI Framework \\u0026 MCP for WordPress 3.4.9″,”sourceHref”:””,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”AI Engine \u2013 The Chatbot, AI Framework \\u0026 MCP for WordPress”,”version”:”3.4.9″,”vendor”:”tigroumeow”,”ai_description”:”Privilege Escalation vulnerability due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path”,”ai_severity”:”High”,”ai_vendor”:”tigroumeow”,”ai_product”:”AI Engine \u2013 The Chatbot, AI Framework \\u0026 MCP for WordPress”,”ai_version”:”3.4.9″,”ai_score”:8.8}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”The AI Engine \u2013 The Chatbot, AI Framework \\u0026 MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,41,12,15,13,7,11,5],"class_list":["post-55125","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n