Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauth_for_authorize function. This makes it possible for unauthenticated attackers to create new administrator accounts with attacker-supplied credentials via a CSRF-based REST authentication bypass, granted they can trick a site administrator into performing an action such as clicking on a link. This bypass can be combined with WordPress's ?_method=POST method-override support to convert a top-navigation GET request into an authenticated POST to the REST users endpoint, requiring no existing account on the attacker's part.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-01 | 2 | Disclosure2 |
| 2026-08-02 | 1 | Patch1 |
AI Engine WordPress plugin (<=3.6.5): click a link, attacker gets admin access. No auth required. CVE-2026-15988, CVSS 8.8, patched in 3.6.6.
Post summary
CVE-2026-15988 in the AI Engine WordPress plugin lets unauthenticated users gain admin access, but the patch (v3.6.6) is already available.
🚨HIGH - WordPress AI Engine CSRF to REST Auth Bypass Admin Creation (CVE-2026-15988) AI Engine – The Chatbot, AI Framework & MCP for WordPress lacks proper nonce validation in reauth_for_authorize, enabling CSRF. An unauth attacker can lure an admin to a crafted link, abuse WordPress ?_method=POST to convert GET navigation into an authenticated POST to /wp-json/wp/v2/users, creating a new administrator with attacker-controlled creds. 👉Affected: AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.6.5
Post summary
The post discloses a CSRF flaw in WordPress AI Engine that enables an unauthenticated attacker to create a new administrator via the REST API, with no PoC, exploit, or patch mentioned.
CVE-2026-15988 - CSRF in AI Engine WordPress plugin enables attacker to create admin accounts via REST auth bypass. CVSS 8.8. Unpatched - disable plugin now. #CVE #WordPress #infosec #cvealert #splunk #yara #sigma #100daysofcybersecurity #cybersecurityawareness #cybersecuritynews #cybersecuritytips #developer #developers #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #python https://www.valtersit.com/cve/CVE-2026-15988
Post summary
CVE-2026-15988 is a CSRF vulnerability in the AI Engine WordPress plugin that lets attackers create admin accounts through a REST auth bypass; users are urged to disable the plugin until a patch is available.