Do Son A Critical (CVSS 9.8) Auth Bypass in AI Engine is actively exploited. The flaw exposes the MCP bearer token via the REST API when No-Auth URL is enabled, allowing admin takeover.
AI Engine
A critical flaw (CVE-2025-5071) in WordPress's AI Engine plugin allows subscribers to escalate privileges and take over websites with Dev Tools/MCP enabled.