🔐 CVE Alert

CVE-2025-5071

HIGH 8.8

AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP

CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th

The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs_MCP::can_access_mcp' function in versions 2.8.0 to 2.8.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the MCP and run various commands like 'wp_create_user', 'wp_update_user' and 'wp_update_option', which can be used for privilege escalation, and 'wp_update_post', 'wp_delete_post', 'wp_update_comment' and 'wp_delete_comment', which can be used to edit and delete posts and comments.

CWE CWE-863
Vendor tigroumeow
Product ai engine
Published Jun 19, 2025
Last Updated Jun 20, 2025
Stay Ahead of the Next One

Get instant alerts for tigroumeow ai engine

Be the first to know when new high vulnerabilities affecting tigroumeow ai engine are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

tigroumeow / AI Engine
2.8.0 ≤ 2.8.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/0e7654a1-0020-4bf1-86be-bdb238a9fe0d?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.8.1/labs/mcp.php#L43 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3313554/ai-engine#file21

Credits

István Márton