AI Engine: anyone could register an MCP OAuth client on a site

01What happened

Wordfence disclosed CVE-2026-110732 against the AI Engine plugin on October 29, 2026, and the CVE record was published a day later. The record credits the finder as satoshigpt2021-sketch and says the developer was notified on October 14. AI Engine turns a WordPress site into an MCP server that assistants such as Claude and ChatGPT connect to.

02How it works

The dynamic client registration route /wp-json/mcp/v1/oauth/register shipped with a permission callback of __return_true, so an unauthenticated request could register an active OAuth client with an attacker-controlled redirect URI. Once an administrator approved that client on the consent screen, the attacker held an administrator-bound MCP access token and could drive the plugin's MCP tools with admin rights. The consent page also set no X-Frame-Options or frame-ancestors headers, so the approval could be collected by clickjacking. Wordfence classes the weakness as CWE-862, missing authorization.

03Who is affected

Sites running AI Engine 3.8.6 or earlier are exposed, and the plugin's directory listing reports more than 90,000 active installations. An administrator still has to approve the registered client, which is why the record scores attack complexity high and user interaction required.

04What to do

Update AI Engine to 3.8.7 or later; its changelog says the MCP sign-in page can no longer be framed by other sites. On sites that ran an affected version, revoke MCP OAuth tokens and registered clients you cannot account for, and treat an unexpected MCP consent prompt as an attack rather than a glitch.

Sources 3 links, all fetched

1. 1github.comGitHub Advisory
2. 2cveawg.mitre.orgCVE Record
3. 3wordpress.orgPlugin Page