CVE-2026-110732

AI Engine MCP OAuth consent can be abused for administrator access

Meow Apps / tigroumeow · AI Engine WordPress plugin MCP OAuth

First documented disclosure · Review checkpoint

Summary

An attacker-controlled OAuth client can receive administrator-bound MCP access after administrator consent.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: Reviewed primary evidence does not establish malicious exploitation or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Unauthenticated dynamic client registration accepts attacker redirects; the affected consent page lacks anti-framing headers, enabling clickjacking of the approval step.

Conditions required

The MCP OAuth feature must be enabled and an administrator must approve the attacker’s client, potentially through clickjacking. Registration alone does not provide an administrator token.

Potential impact

Administrator-level actions through MCP tools, including user creation and option changes, after the required approval.

Affected versions and configurations

AI Engine through 3.8.6.

Fix and mitigation status

3.8.7 adds anti-framing headers, destination disclosure and impersonation warnings to MCP consent.

Practical next steps

Upgrade to a supported release containing the fix. Review connected MCP applications and revoke unrecognized grants; use limited access where appropriate and approve only intended clients.

Operating lesson

OAuth consent is a security boundary: prevent framed approval and make the client and redirect destination clear.

Evidence and limits

The public 3.8.7 SVN tag and security changelog dated October 23 explicitly expose the consent hardening; its source comment names this exact CVE. Wordfence’s CNA timeline calls October 29 the disclosure and published the record October 30. Public dynamic client registration remains intentional in the patched code; the fix hardens informed consent rather than proving that registration alone was an authentication bypass. Wordfence’s page returned an empty body and Trac returned 403; official versioned SVN source and the full CNA were reviewed instead.

Sources