Threats tagged 'ghsa-q6x7-qqgq-h832'

The AI Engine plugin for WordPress versions up to and including 3.1.3 has a vulnerability that exposes sensitive information via the /mcp/v1/ REST API endpoint when the 'No-Auth URL' feature is enabled. This exposure reveals the Bearer Token to unauthenticated attackers, allowing them to hijack valid sessions and perform privileged actions such as creating new administrator accounts, resulting in privilege escalation.