Critical vulnerability reported in AI Engine WordPress plugin
Learn More
A critical security vulnerability is reported in the AI Engine WordPress plugin that enables unauthenticated attackers to extract bearer tokens and escalate their privileges to administrator level, potentially leading to complete site compromise.
The AI Engine plugin integrates the Model Context Protocol (MCP) with artificial intelligence agents such as Claude and ChatGPT, enabling these AI systems to perform complex WordPress management tasks including user account modifications, media handling, content editing, and site administration. The plugin uses a bearer token—essentially a master password—that authorizes AI agents to execute privileged commands on WordPress sites.
The flaw is tracked as CVE-2025-11749 (CVSS score 9.8) and is caused by improper REST API endpoint registration within the plugin's Meow_MWAI_Labs_MCP class when administrators enable the "No-Auth URL" feature in the MCP settings. When this feature is activated, the plugin registers REST API routes that embed the bearer token directly in the endpoint path, such as /mcp/v1/[token]/sse and /mcp/v1/[token]/messages. Because the developers didn't include the 'show_in_index => false' parameter during REST route registration, WordPress automatically listing these sensitive URLs, complete with the bearer token in the publicly accessible REST API index at /wp-json/. Any unauthenticated attacker could access this public index, retrieve the exposed bearer token, and use it to authenticate to the MCP endpoint without any credentials.
Once an attacker obtains the bearer token, they gain full access to execute administrator-level commands through the MCP interface. Security researchers demonstrated that attackers can use commands such as 'wp_update_user' to modify their own user role to administrator.
The vulnerability affects all versions of AI Engine up to and including 3.1.3 where the "No-Auth URL" setting has been manually enabled in the MCP configuration. That setting is disabled by default.
AI Engine version 3.1.4 on October 19, 2025 patches this flaw by adding the 'show_in_index => false' argument to all "No-Auth URL" endpoints.
The patch alone is insufficient for sites that previously had the "No-Auth URL" feature enabled. Any bearer token that was exposed before the patch remains compromised, as attackers may have already harvested these tokens from the public API index. For these affected sites administrators must patch AND rotate the bearer token in the AI Engine settings page to invalidate any previously exposed credentials.
