CVE-2026-15988 is a CSRF vulnerability in the AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin affecting all versions up to 3.6.5. The vulnerability is due to missing or incorrect nonce validation on the reauth_for_authorize function. An attacker can exploit this by tricking an authenticated site administrator into clicking a crafted link, enabling the creation of new administrator accounts with attacker-supplied credentials through a REST authentication bypass. The attack leverages WordPress's ?_method=POST method-override to convert a GET request into an authenticated POST to the REST users endpoint without requiring any existing attacker account.

Successful exploitation allows unauthenticated attackers to create new administrator accounts on vulnerable WordPress sites, leading to full administrative control. This compromises confidentiality, integrity, and availability of the affected site, as indicated by the CVSS vector (Confidentiality: High, Integrity: High, Availability: High).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided at this time. Until a patch is available, administrators should avoid clicking on untrusted links and consider disabling or restricting the plugin's REST endpoints if possible.