PT-2025-26211 · WordPress · Ai Engine Wordpress Plugin

István Márton · Published 2025-06-19 · Updated 2025-08-11 · CVE-2025-5071

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WordPress AI Engine plugin (affected versions not specified)

Description A critical flaw in WordPress's AI Engine plugin allows subscribers to escalate privileges and take over websites with Dev Tools/MCP enabled.

Recommendations Update the WordPress AI Engine plugin to the latest version. As a temporary workaround, consider disabling the Dev Tools/MCP feature until a patch is available. Restrict subscriber-level access to minimize the risk of exploitation.

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-16384

CVE-2025-5071

Affected Products

Ai Engine Wordpress Plugin

References · 15

• https://bdu.fstec.ru/vul/2025-16384 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5071 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5071 · Security Note
• https://plugins.trac.wordpress.org/changeset/3313554/ai-engine#file21 · Patch
• https://t.me/cveNotify/131711 · Telegram Post
• https://t.me/cvetracker/26562 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1935518237502132252 · Twitter Post
• https://twitter.com/CVEnew/status/1935723256151261401 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0e7654a1-0020-4bf1-86be-bdb238a9fe0d?source=cve · Note
• https://twitter.com/fridaysecurity/status/1935519365811626370 · Twitter Post
• https://twitter.com/fernandokarl/status/1935790181300252988 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ai-engine/ai-engine-280-283-authenticated-subscriber-insufficient-authorization-to-privilege-escalation-via-mcp · Note
• https://t.me/latest_high_impact_cve/2718 · Telegram Post
• https://t.me/cvenotify/126160 · Telegram Post
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.8.1/labs/mcp.php#L43 · Note