Introduction
A missing capability check in the AI Engine WordPress plugin's MCP OAuth authorization path allowed any authenticated user, even a Subscriber, to obtain a bearer token with full access to admin-level MCP tools. The plugin has over 100,000 active installations, so the exposure across the WordPress ecosystem is significant.
AI Engine is a popular WordPress plugin from Meow Apps. It provides chatbots, AI-powered content generation, AI forms, and a Model Context Protocol (MCP) server that external AI agents can connect to. Because it links WordPress sites to various AI services, it is common on sites that use AI features. Version 3.4.9 added OAuth 2.1 with Dynamic Client Registration to the MCP server, and the authorization gap appeared in that new code.
Technical Information
The root cause of CVE-2026-8719 is improper privilege management (CWE-269) in the MCP OAuth bearer token flow. When version 3.4.9 added OAuth 2.1 support to the MCP server, the authorization layer was built to confirm that each token was authentic (not expired, not revoked). It never checked whether the WordPress user linked to the token held the administrator capability.
The omission matters because the MCP layer exposes admin-level tools, including operations like wp_create_user. The vulnerable code in labs/mcp.php set the current WordPress user from the token's user ID and nothing more:
// Set current user based on OAuth token wp_set_current_user( $token_data['user_id'] );
No capability gate followed this call. The MCP server trusted the token alone and gave the linked user full access to every MCP tool, whatever their WordPress role.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, for a score of 8.8 (High). The attack works over the network, has low complexity, needs only a Subscriber account, and requires no user interaction.
Attack Flow
Exploitation is straightforward:
- The attacker registers or already holds a Subscriber-level account on the target WordPress site.
- The attacker starts the MCP OAuth authorization flow and requests a bearer token from the plugin's OAuth endpoint.
- The OAuth layer issues a valid token because the user is authenticated. It does not check for the administrator capability.
- With the token in hand, the attacker sends requests to the MCP server endpoint and calls admin-level tools, such as creating new administrator accounts or changing existing user roles.
- The attacker raises their own role to Administrator and takes full control of the site.
The barrier to entry is low. On WordPress sites that allow open registration (a common configuration for membership or community sites), anyone who can create an account can exploit this vulnerability.
Patch Information
The vulnerability was patched in AI Engine version 3.5.0, released on May 16, 2026, through WordPress.org plugin changeset 3533527. Wordfence confirms version 3.5.0 as the patched release.
The fix adds a centralized capability gate, a new user_can_authorize() method in labs/mcp-oauth.php:
public function user_can_authorize( $user_id ) { $user_id = (int) $user_id; $allowed = $user_id > 0 && user_can( $user_id, 'administrator' ); return (bool) apply_filters( 'mwai_mcp_oauth_user_can_authorize', $allowed, $user_id ); }
The method wraps the native WordPress user_can() function and confirms that the user is an administrator before any MCP OAuth action goes ahead. Its result passes through the mwai_mcp_oauth_user_can_authorize filter. The code documents that filter as an escape hatch for future multi-user MCP work and warns explicitly that weakening the gate would reintroduce privilege escalation.
The patch enforces the gate at two points.
Enforcement at authorization time (labs/mcp-oauth.php): Before it renders the OAuth consent page, the plugin now checks whether the logged-in user is an administrator. If not, the authorization flow stops immediately:
if ( !$this->user_can_authorize( $user->ID ) ) { if ( $this->logging ) { error_log( '[AI Engine MCP OAuth] ❌ Non-admin user ' . $user->ID . ' tried to authorize client ' . $params['client_id'] ); } $this->render_error_page( 'Only administrators can authorize MCP applications on this site.' ); exit; }
The same check runs again in the authorization form submission handler, so a non-admin user cannot get around the UI by crafting a direct POST request.
Enforcement at token validation time (labs/mcp.php): This is the defense-in-depth layer. Even if a token was issued before the patch (or stored from before the authorize-time admin gate landed), the MCP request handler now checks the linked user's current capabilities every time the token is used:
if ( !$this->oauth->user_can_authorize( $token_data['user_id'] ) ) { if ( $this->logging ) { error_log( '[AI Engine MCP] ❌ OAuth token rejected: user ' . $token_data['user_id'] . ' is not an administrator.' ); } return false; }
This second check is particularly thoughtful. Without it, tokens minted to non-admin users before the upgrade to 3.5.0 would still grant full MCP access. Because the patch re-checks capabilities at validation time, pre-existing tokens held by Subscriber-level users stop working as soon as the site upgrades.
The security-critical changes are confined to labs/mcp-oauth.php and labs/mcp.php. The changeset also includes updates unrelated to the vulnerability: model deprecation tags, finetune deprecation notices, and CSS fixes.
Affected Systems and Versions
The vulnerability affects AI Engine version 3.4.9 specifically. Version 3.5.0 and later contain the fix.
A WordPress site running AI Engine 3.4.9 is potentially vulnerable if the MCP server is enabled and user registration is open, or if non-administrator accounts already exist. Sites that do not use the MCP OAuth feature, or that limit all accounts to administrators, have reduced exposure. Updating is still the recommended course of action for them.
Vendor Security History
Meow Apps, led by developer Jordy Meow, has a documented history of responding quickly to security disclosures. CVE-2025-7847 was an arbitrary file upload vulnerability in AI Engine versions 2.9.3 and 2.9.4. The vendor received that disclosure on July 18, 2025, and released a fully patched version (2.9.5) by July 22, 2025. Wordfence publicly commended the developer for the prompt response.
The vendor followed the same pattern with CVE-2026-8719, releasing version 3.5.0 shortly after version 3.4.9 went out. That track record supports keeping auto-updates enabled for this plugin.
