AI Engine 3.4.9 - Subscriber+ Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token

Description

The plugin is vulnerable to Privilege Escalation due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any valid OAuth token causes MCP access to be granted without verifying administrator privileges. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke admin-level MCP tools and escalate privileges to Administrator.