Missing Authorization in AI Engine Plugin for WordPress Affects User Security

CVE-2026-110732

What is CVE-2026-110732?

The AI Engine plugin for WordPress has a vulnerability that allows unauthenticated users to register active OAuth clients due to improper authorization checks in its Dynamic Client Registration endpoint. This vulnerability stems from the permission_callback being set to __return_true, enabling an attacker to manipulate the redirect URI. Once the attacker controls the OAuth client, they can acquire an administrator-bound access token, potentially gaining full administrative privileges upon consent approval. Additionally, the consent page lacks essential security headers such as X-Frame-Options and Content-Security-Policy frame-ancestors, making it susceptible to clickjacking attacks, thereby further compromising site security.

References