AI Engine <= 3.8.6 - Unauthenticated Clickjacking via MCP OAuth Consent Page
- ID
- WPSEC-2026-1576
- Plugin
- AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini (ai-engine)
- Affected
- from 3.4.9 before 3.8.7
- Remediation
- Update to 3.8.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-1021
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- AI Engine on WPSec AttackSurface
- Fix released
- Published
Description
The AI Engine plugin for WordPress is vulnerable to Clickjacking via the MCP OAuth authorization consent page in versions 3.4.9 up to, and including, 3.8.6, due to the page being sent without X-Frame-Options or Content-Security-Policy frame-ancestors headers. Any client can register through Dynamic Client Registration, so this makes it possible for unauthenticated attackers to load the consent page for their own client in a hidden frame and trick a logged-in administrator into clicking Approve. The authorization code is then sent to the attacker's redirect URI, which gives the attacker an MCP access token carrying the administrator's privileges. Exploitation requires the MCP server to be enabled, the victim to interact with the page, and a browser that sends WordPress cookies to framed cross-site pages.
References
- https://wpsec.com/vuln/WPSEC-2026-1576/
- https://plugins.svn.wordpress.org/ai-engine/tags/3.8.7/
- https://wordpress.org/plugins/ai-engine/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS