Threats tagged 'ghsa-22w7-p44p-2gq7'

The AI Engine WordPress plugin up to version 3.8.6 has a Missing Authorization vulnerability in its MCP module's OAuth 2.1 Dynamic Client Registration endpoint. This flaw allows unauthenticated users to register OAuth clients with attacker-controlled redirect URIs. If an administrator approves the malicious client on the OAuth consent screen, attackers can gain administrator-level control, including user creation and option updates. The consent page lacks protections against clickjacking, increasing the risk of unauthorized approval.