incibe.esadvisoryCVE-2026-15988 | INCIBE-CERT | INCIBE
CVE-2026-15988 describes a CSRF vulnerability (CVSS 8.8, CWE-352) in the "AI Engine – The Chatbot, AI Framework & MCP" WordPress plugin, affecting all versions up to and including 3.6.5. Missing/incorrect nonce validation on the reauth_for_authorize function lets an unauthenticated attacker trick a logged-in administrator into visiting a crafted link, which — combined with WordPress's ?_method=POST override to turn a GET into an authenticated REST POST — creates a new administrator account with attacker-supplied credentials.
TL;DR CSRF flaw in the AI Engine WordPress plugin (≤3.6.5) lets attackers CSRF-trick admins into creating rogue admin accounts via a REST method-override bypass.
Organisations named here
- CWE-352
CVEs named here
- CVE-2026-15988
Technologies named here
- WordPress
Techniques named here
- Cross-Site Request Forgery
- HTTP method override abuse
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup