CVE-2026-75796
AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.
| Vendor | unknown |
| Product | ai engine |
| Published | Aug 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown ai engine
Be the first to know when new unknown vulnerabilities affecting unknown ai engine are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / AI Engine
2.8.0 < 3.6.1
References
Credits
Charles Vosburgh WPScan