WordPress Plugin Vulnerabilities

AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools

Description

The plugin does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.

Proof of Concept

Affects Plugins

Plugin icon
ai-engine
Fixed in 3.6.1

References

CVE
CVE-2026-75796

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Charles Vosburgh
Submitter
Charles Vosburgh
Submitter website
https://www.linkedin.com/in/charles-vosburgh/
Verified
Yes
WPVDB ID
919da0c7-7643-4903-9454-2fb66353f5cb

Timeline

Publicly Published
2026-08-19 (about 2 days ago)
Added
2026-08-19 (about 1 day ago)
Last Updated
2026-08-19 (about 1 day ago)

Other

Published
Title
Published
2020-01-01
Title
Import Users From CSV with Meta 1.15 - Unauthorised Authenticated Users Export
Published
2025-01-14
Title
Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation
Published
2022-09-13
Title
WPGateway <= 3.5 - Unauthenticated Privilege Escalation
Published
2020-01-24
Title
wpCentral < 1.4.8 - Privilege Escalation
Published
2026-07-31
Title
Subscriptions for WooCommerce < 2.0.1 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta