CVE-2026-15988 is a high-severity CSRF vulnerability (CWE-352) in the AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin affecting all versions up to and including 3.6.5. The vulnerability is due to missing or incorrect nonce validation on the reauth_for_authorize function, allowing unauthenticated attackers to create new administrator accounts by exploiting a CSRF-based REST authentication bypass. This bypass can be combined with WordPress's ?_method=POST method-override feature to convert a GET request into an authenticated POST request to the REST users endpoint, enabling privilege escalation without prior authentication. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to create new administrator accounts on affected WordPress sites, leading to full site compromise. This includes complete control over site content, settings, and user management, severely impacting confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should avoid clicking on untrusted links and consider disabling or restricting access to the vulnerable plugin. Monitoring for suspicious account creations and applying strict administrative access controls may help mitigate risk.