PT-2025-27847 · WordPress · Ai Engine

István Márton · Published 2025-07-04 · Updated 2025-08-13 · CVE-2025-6238

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: AI Engine plugin for WordPress version 2.8.4

Description: The issue is due to an insecure OAuth implementation, specifically the lack of validation for the redirect uri parameter during the authorization flow. This allows unauthenticated attackers to intercept the authorization code and obtain an access token by redirecting the user to an attacker-controlled URI.

Recommendations: For version 2.8.4, update to version 2.8.5, where OAuth is disabled and the 'Meow MWAI Labs OAuth' class is not loaded, thus mitigating the open redirect vulnerability.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-6238

Affected Products

Ai Engine

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-6238 · Security Note
• https://plugins.trac.wordpress.org/changeset/3321384/ai-engine/trunk/labs/mcp.php · Patch
• https://osv.dev/vulnerability/CVE-2025-6238 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3321384/ai-engine/trunk/labs/oauth.php · Patch
• https://wordfence.com/threat-intel/vulnerabilities/id/1edc84fd-8cb5-4899-9444-1b6ae3144917?source=cve · Note
• https://twitter.com/cracbot/status/1942901587422441978 · Twitter Post
• https://twitter.com/jmdevlabs/status/1946592588644978991 · Twitter Post
• https://t.me/cvenotify/127686 · Telegram Post
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.8.4/labs/oauth.php · Note
• https://twitter.com/marcin_brz81183/status/1946616893067948329 · Twitter Post
• https://t.me/cveNotify/132138 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1941008706142921130 · Twitter Post