CVE-2026-15988

Name of the Vulnerable Software and Affected Versions The AI Engine – The Chatbot, AI Framework & MCP for WordPress versions prior to 3.6.6

Description A Cross-Site Request Forgery (CSRF) issue exists due to missing or incorrect nonce validation in the reauth for authorize() function. This allows unauthenticated attackers to create new administrator accounts using attacker-supplied credentials through a REST authentication bypass. The attack requires tricking a site administrator into clicking a link, which can be combined with the ? method=POST method-override support in WordPress to convert a GET request into an authenticated POST request to the REST users endpoint.

Recommendations Update the plugin to version 3.6.6 or later.