The AI Engine WordPress plugin version 3.4.9 contains a privilege escalation vulnerability (CWE-269) due to improper privilege management. Specifically, the MCP OAuth bearer-token authorization path does not enforce WordPress administrator capability checks, allowing any valid OAuth token holder to gain admin-level access. This flaw permits authenticated users with low-level roles (Subscriber+) to escalate privileges to Administrator by accessing MCP tools without proper authorization verification. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with any valid OAuth token and at least Subscriber-level access can escalate privileges to Administrator within the affected WordPress plugin. This compromises confidentiality, integrity, and availability of the system by granting full administrative control over the MCP tools and potentially the WordPress site. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor vendor communications for updates. Until a patch is available, restrict OAuth token issuance to trusted users only and consider limiting access to the affected plugin or disabling it if feasible to reduce risk.