The AI Engine WordPress plugin versions before 3.6.1 do not verify that the requesting user is authorized to act on the targeted account before executing privileged user management operations. This improper privilege management (CWE-269) allows an Administrator on a Multisite sub-site to escalate privileges and take control of any account on the entire network, including the Network Administrator's account. The vulnerability affects at least version 2.8.0 as explicitly stated. No CVSS score or official remediation level is provided, and no known exploits are reported in the wild.

An attacker with Administrator privileges on a Multisite sub-site can escalate their privileges to take over any account on the WordPress network, including the highest privileged Network Administrator account. This could lead to full network compromise, unauthorized access, and control over all sites within the multisite network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.6.1, upgrading to version 3.6.1 or later is likely recommended once confirmed by the vendor. Until then, restrict Administrator role assignments on Multisite sub-sites to trusted users only.