# AI Engine: anyone could register an MCP OAuth client on a site

> AI Engine's MCP module accepted OAuth client registrations from unauthenticated callers, up to and including version 3.8.6.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Wordfence
- **Disclosed:** 2026-10-29
- **CVE:** CVE-2026-110732
- **CVSS:** 7.5
- **Affects:** AI Engine, WordPress
- **Research by:** satoshigpt2021-sketch
- **Primary source:** https://github.com/advisories/GHSA-22w7-p44p-2gq7
- **Page:** https://theinjection.dev/items/ai-engine-mcp-oauth-client-registration/

AI Engine, a WordPress plugin with 90,000-plus installs, let unauthenticated callers register an MCP OAuth client in versions up to 3.8.6. An administrator who approves the client hands the attacker an admin-bound MCP token. Fixed in 3.8.7.

## What happened

Wordfence disclosed CVE-2026-110732 against the AI Engine plugin on October 29, 2026, and the CVE record was published a day later. The record credits the finder as satoshigpt2021-sketch and says the developer was notified on October 14. AI Engine turns a WordPress site into an MCP server that assistants such as Claude and ChatGPT connect to.

## How it works

The dynamic client registration route /wp-json/mcp/v1/oauth/register shipped with a permission callback of __return_true, so an unauthenticated request could register an active OAuth client with an attacker-controlled redirect URI. Once an administrator approved that client on the consent screen, the attacker held an administrator-bound MCP access token and could drive the plugin's MCP tools with admin rights. The consent page also set no X-Frame-Options or frame-ancestors headers, so the approval could be collected by clickjacking. Wordfence classes the weakness as CWE-862, missing authorization.

## Who is affected

Sites running AI Engine 3.8.6 or earlier are exposed, and the plugin's directory listing reports more than 90,000 active installations. An administrator still has to approve the registered client, which is why the record scores attack complexity high and user interaction required.

## What to do

Update AI Engine to 3.8.7 or later; its changelog says the MCP sign-in page can no longer be framed by other sites. On sites that ran an affected version, revoke MCP OAuth tokens and registered clients you cannot account for, and treat an unexpected MCP consent prompt as an attack rather than a glitch.

## Quick facts

- **Affected:** AI Engine 3.8.6 and earlier
- **Fixed in:** 3.8.7, released October 23, 2026
- **CVE:** CVE-2026-110732
- **CVSS 3.1:** 7.5 (Wordfence)
- **Found by:** satoshigpt2021-sketch
- **Disclosed:** Developer notified October 14, 2026; disclosed October 29, 2026
- **Attack type:** Unauthenticated MCP OAuth client registration, CWE-862

## Sources

1. [GitHub Advisory](https://github.com/advisories/GHSA-22w7-p44p-2gq7)
2. [CVE Record](https://cveawg.mitre.org/api/cve/CVE-2026-110732)
3. [Plugin Page](https://wordpress.org/plugins/ai-engine/)