PT-2025-26211 · WordPress · Ai Engine Wordpress Plugin

István Márton · Publicado 2025-06-19 · Atualizado 2025-08-11 · CVE-2025-5071

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WordPress AI Engine plugin (affected versions not specified)

Description A critical flaw in WordPress's AI Engine plugin allows subscribers to escalate privileges and take over websites with Dev Tools/MCP enabled.

Recommendations Update the WordPress AI Engine plugin to the latest version. As a temporary workaround, consider disabling the Dev Tools/MCP feature until a patch is available. Restrict subscriber-level access to minimize the risk of exploitation.

Correção

LPE

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BDU:2025-16384

CVE-2025-5071

Produtos afetados

Ai Engine Wordpress Plugin

Referências · 15

• https://t.me/cveNotify/131711 · Publicação no Telegram
• https://t.me/cvetracker/26562 · Publicação no Telegram
• https://twitter.com/the_yellow_fall/status/1935518237502132252 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1935723256151261401 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2025-16384 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-5071 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-5071 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/0e7654a1-0020-4bf1-86be-bdb238a9fe0d?source=cve · Nota
• https://twitter.com/fridaysecurity/status/1935519365811626370 · Publicação no Twitter
• https://twitter.com/fernandokarl/status/1935790181300252988 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ai-engine/ai-engine-280-283-authenticated-subscriber-insufficient-authorization-to-privilege-escalation-via-mcp · Nota
• https://t.me/latest_high_impact_cve/2718 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset/3313554/ai-engine#file21 · Correção
• https://t.me/cvenotify/126160 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.8.1/labs/mcp.php#L43 · Nota