Security Advisory · Published 2026-05-17

AI Engine WordPress Plugin CVE-2026-8719: 5-Minute Self-Check

CVE-2026-8719 is a privilege escalation in the AI Engine WordPress plugin (50,000+ active installs) that lets any logged-in user, even a Subscriber, walk themselves up to Administrator. The plugin's MCP OAuth path skips the capability check, so a free-account signup is enough to take over a site running v3.4.9 or earlier. Five quick checks confirm whether you're affected. The whole thing takes 5 to 10 minutes.

TL;DR

  • CVE: CVE-2026-8719. CVSS 3.1: 8.8 (HIGH). CWE-269 improper privilege management.
  • Plugin: AI Engine (slug: ai-engine) by Jordy Meow / Meow Apps. Versions ≤ 3.4.9 are vulnerable.
  • Patch: AI Engine v3.4.10. Upstream fix landed as plugins.trac changeset 3533527.
  • Who can exploit: any logged-in user at Subscriber or higher. On sites that allow public registration, that's anyone with an email address.
  • Detection time: 5 minutes for plugin version + admin user audit. 15 minutes for full confidence including file integrity.
  • Wordfence advisory: Wordfence Threat Intel CVE-2026-8719.

Why "PR:L" doesn't mean "low risk" here

The CVSS vector says PR:L: low privilege required. That sounds like a downgrade from the pre-auth issues already tracked this year (CVE-2026-41940, CVE-2026-1492). In practice, this one can be worse than the score reads.

The common exposure pattern is simple: public registration is enabled for the WordPress install, AI Engine is active, and the MCP server toggle is on. An attacker can register a Subscriber account and use the vulnerable plugin path to reach Administrator access. No phishing or credential stuffing is required.

If the site does not actively use Subscriber accounts, disable public registration before doing anything else. Step 4 below covers the exact setting.

5-step self-check

Step 1. Verify the plugin version

Log into wp-admin. Go to Plugins → Installed Plugins. Find AI Engine (full name: "AI Engine — The Chatbot, AI Framework & MCP for WordPress"). Note the version number on the right.

If you can't see it from the admin UI for any reason, SSH or FTP into the site and check: 

grep "Stable tag" wp-content/plugins/ai-engine/readme.txt
grep "Version:" wp-content/plugins/ai-engine/ai-engine.php

Version comparison:

  • 3.4.10 or higher: patched. Move to Step 2 to confirm no residue.
  • 3.4.9 or lower: vulnerable. Update first, audit second. WP Admin → Plugins → Update Now. If auto-updates are disabled, manually download v3.4.10+ from wordpress.org/plugins/ai-engine.
  • Plugin not installed: this CVE doesn't apply to you. Bookmark the page in case you install it later.

Step 2. Audit the administrator list (the visible part)

In wp-admin, go to Users → All Users → Administrator. Note every account. For each one, ask three questions:

  • Did you or your team create it?
  • Does the email address match someone you trust?
  • Is the registration date consistent with when you'd expect that account?

Sort by Registered column (newest first). Anything created after AI Engine was installed but before you patched is suspicious. Don't delete anything yet. Note them and move to Step 3 first to make sure you're seeing the full picture.

Step 3. Run the hidden-admin query

Same trick as CVE-2026-1492. The wp-admin Users page is just a UI on top of wp_users + wp_usermeta. If an attacker writes directly to wp_usermeta setting wp_capabilities to administrator, the Users page might still display the account as Subscriber. The actual capability check on every request reads wp_usermeta, not the display label.

Open phpMyAdmin (or any MySQL client). Run: 

SELECT u.ID, u.user_login, u.user_email, u.user_registered,
       um.meta_value AS capabilities
FROM wp_users u
JOIN wp_usermeta um ON u.ID = um.user_id
WHERE um.meta_key = 'wp_capabilities'
  AND um.meta_value LIKE '%administrator%'
ORDER BY u.user_registered DESC;

Replace wp_ with your actual table prefix if you customized it. The result is the true list of administrators. Compare against your wp-admin list from Step 2:

  • Same accounts in both lists: clean. Move on.
  • Extra accounts in the SQL list (not visible in wp-admin): hidden admin. You're compromised. Skip to Step 5 and consider professional help.
  • Accounts you don't recognize anywhere: rogue admin from any source, not necessarily this CVE. Same response: treat as compromise.

Step 4. Lock down the MCP / OAuth attack surface

Even after patching, harden the configuration so future MCP-related CVEs (and there will be more, MCP is brand new) don't bite as hard.

In wp-admin, go to Meow Apps → AI Engine → Settings. Look for the MCP / OAuth section.

  • If you don't use MCP (most sites running AI Engine for chatbot only): turn off the MCP server toggle and OAuth bearer token toggle entirely. You're not using them. They're just attack surface.
  • If you do use MCP (you connect Claude Desktop or ChatGPT to your site for AI workflows): keep MCP on, but rotate any existing OAuth tokens and audit which clients have access. Settings → MCP → Active OAuth Clients.

Then lock public registration if you don't actively use it: Settings → General → "Anyone can register". Uncheck. The default New User Default Role doesn't matter if nobody can register.

For sites that need public registration (membership, WooCommerce with customer accounts): you can't disable it, but make sure the default role is Customer or Subscriber, not anything higher. Settings → General → New User Default Role → Subscriber.

Step 5. File integrity + recent changes audit

If you found anything suspicious in Steps 2 or 3, the attacker likely planted persistence in the file system too. Quick checks to run:

Find PHP files modified in the last 30 days under wp-content/: 

find wp-content/ -name "*.php" -mtime -30 -ls

Compare AI Engine plugin files against the official zip: 

# Download the patched version
wget https://downloads.wordpress.org/plugin/ai-engine.3.4.10.zip
unzip -d /tmp/ai-engine-clean ai-engine.3.4.10.zip

# Diff against your live install
diff -r /tmp/ai-engine-clean/ai-engine wp-content/plugins/ai-engine

Any file present in your install but not in the clean zip is suspicious. Any modified file with size mismatch is also worth a closer look (open it, search for eval(, base64_decode, gzinflate, or any opaque encoded blob).

Check uploads for stray PHP. WordPress doesn't write executable PHP to wp-content/uploads/ in normal operation. Anything in there is almost certainly a web shell: 

find wp-content/uploads/ -name "*.php" -ls

Output should be empty on a clean install. If it's not, you have a problem.

What to do if any step came up red

Hidden admin accounts, modified plugin files, unexpected PHP in uploads, all three are compromise indicators. Don't panic and don't try to "clean as you go." The work order that actually works:

First, update AI Engine to v3.4.10+ to close the door. This is non-negotiable. Even if you find compromise, the attacker still has the same way back in until you patch.

Second, snapshot the database and the wp-content/ directory. You'll want these for forensics and as a "before cleanup" reference. wp db export pre-cleanup.sql is fastest.

Third, force-logout every user. wp user session destroy --all. Then rotate all administrator passwords and regenerate the WordPress secret keys in wp-config.php (use the official salt generator). Salt rotation invalidates every existing session cookie.

Fourth, walk the full WordPress recovery playbook. It covers database surgery (rogue admins, malicious options), clean-source plugin reinstalls, and hardening so you don't end up here again next month.

FAQ

I'm on AI Engine v3.4.10 already. Am I done?

You're patched, but if you ran v3.4.9 in production for any window, do Steps 2 and 3 anyway. The patch closes the door. It doesn't undo whatever was already done before you closed it.

I don't see "MCP / OAuth" in AI Engine settings. Am I safe?

The MCP server is a toggle that may not be enabled on every install, but the vulnerable code path is in the plugin regardless of whether the UI shows it. Treat any v ≤ 3.4.9 install as vulnerable until updated.

How do I stop this from happening with the next plugin?

Three things help. Auto-updates on all plugins (the kind of vulnerability AI Engine had gets patched within hours of disclosure; auto-update closes the window for you). Public registration off unless you need it. A WAF (Wordfence Premium, Patchstack, or hosted equivalents) that filters known exploit patterns even before you've patched.

Can I run this self-check without giving anyone access?

Yes for Step 1. Steps 2 to 5 require admin access to your own site (wp-admin and phpMyAdmin or SSH). None of them require giving outside parties access. If you'd rather have someone walk through it with you, our Quick Patch Call ($49) does exactly that on a screenshare.

References

Wrap-up

AI Engine is a great plugin. The author moves fast and this CVE was patched within days of discovery. The takeaway isn't "stop using it." The takeaway is that any plugin with a stable tag of 3.4.9 right now is a 5-minute fix away from being safe again, and a 15-minute fix away from being safe and confirmed clean. If your check turned up red flags, the WordPress recovery playbook is your next read. If you want help with the audit itself, our $49 Quick Patch Call walks the full check on a screenshare.

Need help with the audit?

Get a senior engineer on a screenshare to walk through Steps 1-5 with you, including the database query and file integrity check. Use this when you found suspicious admin accounts, file changes, or OAuth/MCP exposure you cannot explain.

Request CVE repair

Related guides