# AI Engine <= 3.8.6 - Unauthenticated Clickjacking via MCP OAuth Consent Page

- **ID:** WPSEC-2026-1576
- **Plugin:** AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini (`ai-engine`), https://wordpress.org/plugins/ai-engine/
- **Affected versions:** from 3.4.9 before 3.8.7
- **Fixed in:** 3.8.7 (Update to 3.8.7 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-1021
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-24)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ai-engine
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1576/

## Description

The AI Engine plugin for WordPress is vulnerable to Clickjacking via the MCP OAuth authorization consent page in versions 3.4.9 up to, and including, 3.8.6, due to the page being sent without X-Frame-Options or Content-Security-Policy frame-ancestors headers. Any client can register through Dynamic Client Registration, so this makes it possible for unauthenticated attackers to load the consent page for their own client in a hidden frame and trick a logged-in administrator into clicking Approve. The authorization code is then sent to the attacker's redirect URI, which gives the attacker an MCP access token carrying the administrator's privileges. Exploitation requires the MCP server to be enabled, the victim to interact with the page, and a browser that sends WordPress cookies to framed cross-site pages.

## References

- https://wpsec.com/vuln/WPSEC-2026-1576/
- https://plugins.svn.wordpress.org/ai-engine/tags/3.8.7/
- https://wordpress.org/plugins/ai-engine/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1576/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.