The AI Engine plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in all versions up to 3.1.3. When the 'No-Auth URL' option is enabled, the /mcp/v1/ REST API endpoint leaks the Bearer Token to unauthenticated users. This token can be leveraged to gain unauthorized access to the system, including the ability to create new administrator accounts, effectively escalating privileges. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

An unauthenticated attacker can retrieve the Bearer Token from the exposed REST API endpoint, enabling them to hijack valid sessions. This access allows the attacker to perform high-impact actions such as creating new administrator accounts, leading to full privilege escalation within the affected WordPress environment. The vulnerability compromises confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable the 'No-Auth URL' feature to prevent exposure of the Bearer Token. Monitor vendor communications closely for updates and apply patches promptly once available.