Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any valid OAuth token causes MCP access to be granted without verifying administrator privileges. This makes it possible for authenticated (Subscriber+) attackers to invoke admin-level MCP tools and escalate privileges to Administrator.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-17 | 1 | Disclosure1 |
| 2026-05-18 | 1 | Active Exploitation1 |
Attention, elevated activities detected targeting tigroumeow AI Engine Plugin (CVE-2026-8719) https://vuldb.com/vuln/364388/cti
Post summary
The text indicates that active exploitation activities have been detected against CVE-2026-8719, with a reference link to a potential exploit resource, but it does not provide detailed technical or patch information.
CVE-2026-8719 Privilege Escalation in The AI Engine WordPress Plugin 3.4.9 via MCP OAut... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-8719 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
A new CVE (CVE-2026-8719) for a privilege escalation flaw in The AI Engine WordPress Plugin 3.4.9 has been announced, with a link directing readers to a vulnerability details page on vulmon.com, but no PoC, exploit code, or patch information is provided.