263 matches found
CVE-2025-11749 AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract th...
WordPress AI Engine plugin <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation vulnerability
Unauthenticated Sensitive Information Exposure to Privilege Escalation vulnerability discovered by Emiliano Versini in WordPress Plugin AI Engine versions = 3.1.3...
VulnCheck KEV: CVE-2025-11749
The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract th...
WordPress plugin AI Engine δΏ‘ζ―ζ³ι²ζΌζ΄
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. An information...
PT-2025-45071
Name of the Vulnerable Software and Affected Versions AI Engine plugin for WordPress versions prior to 3.1.4 AI Engine versions 2.8.x and 2.9.x prior to 2.9.5 Description The AI Engine plugin for WordPress has a Sensitive Information Exposure issue via the /mcp/v1/ REST API endpoint. When the...
100,000 WordPress Sites Affected by Privilege Escalation Vulnerability in AI Engine WordPress Plugin
On October 4th, 2025, we received a submission for a Sensitive Information Exposure vulnerability in AI Engine, a WordPress plugin with more than 100,000 active installations. This vulnerability can be exploited by unauthenticated attackers to extract the bearer token and then get full access to...
WordPress AI Engine Plugin MCP Unauthenticated Admin Creation to RCE
This module exploits an unauthenticated vulnerability in the WordPress AI Engine plugin versions use exploit/multi/http/wp/aienginemcprce msf undefinedaienginemcprce show actions ...actions... msf undefinedaienginemcprce set ACTION msf undefinedaienginemcprce show options ...show and set options...
EUVD-2024-26139
Malicious code in bioql PyPI...
EUVD-2024-16489
Malicious code in bioql PyPI...
EUVD-2025-28374
Malicious code in bioql PyPI...
EUVD-2024-37627
Malicious code in bioql PyPI...
EUVD-2025-20373
Malicious code in bioql PyPI...
EUVD-2025-22507
Malicious code in bioql PyPI...
EUVD-2024-26129
Malicious code in bioql PyPI...
EUVD-2024-16174
Malicious code in bioql PyPI...
EUVD-2024-34800
Malicious code in bioql PyPI...
CVE-2025-8268
The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the restlist and deletefiles functions in all versions up to, and including, 2.9.5. This makes it possible for unauthenticated attackers to list and delete files uploaded ...
CVE-2025-8268
The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the restlist and deletefiles functions in all versions up to, and including, 2.9.5. This makes it possible for unauthenticated attackers to list and delete files uploaded ...
CVE-2025-8268 Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion
The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the restlist and deletefiles functions in all versions up to, and including, 2.9.5. This makes it possible for unauthenticated attackers to list and delete files uploaded ...
CVE-2025-8268 Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion
The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the restlist and deletefiles functions in all versions up to, and including, 2.9.5. This makes it possible for unauthenticated attackers to list and delete files uploaded ...