Recommended action window: Monitor and triage in normal cycle
NVD description
The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract the bearer token, which can be used to gain access to a valid session and perform many actions like creating a new administrator account, leading to privilege escalation.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Full Look Back writeup: how a default REST setting published the secret, why the fix hid the route rather than removing it, and the plugin's MCP CVE pattern: https://cvebrief.com/cve/cve-2025-11749/ https://t.co/bJ3uHvkKdh