AI Engine WordPress Plugin CVE-2026-15988: A Crafted Link Can Create a Secret Admin

A vulnerability that lets an attacker secretly create an administrator account has been found in AI Engine, a popular plugin that adds AI chatbots and text generation to WordPress sites. It is tracked as CVE-2026-15988, with a severity score (CVSS) of 8.8 out of 10 (High).

AI Engine is a go-to plugin used on more than 100,000 sites worldwide. All versions up to and including 3.6.5 are affected, and a fixed release, 3.6.6, is already available. If exploited, an attacker can take over full administrative control of the site. If you haven't updated yet, upgrade to the latest release from the developer, Meow Apps, as soon as possible.

Overview of the vulnerability

Details are published by the WordPress security firm Wordfence in its threat intelligence feed, and in the U.S. government vulnerability database NVD.

Who targets this, and what happens

The people who would exploit this hole are attackers who want to take over WordPress sites and use them for fraudulent ads, malware distribution, or as a springboard for phishing. The targets are any site still running an old version of AI Engine, regardless of size, whether it is a company site, a store site, or a personal blog.

What the attacker does is quietly get a site administrator to open a crafted trap link or page, so that a new administrator account for the attacker is created without the admin ever noticing. The attacker does not need to log in to the site at all. Tricking an administrator into opening the trap page just once is enough to add a hidden backdoor administrator.

Once an administrator account is in the attacker's hands, the site owner is exposed to everything from tampered posts and stolen data to newly planted malware. Ordinary visitors to the site can also be sent to fake login pages or made to download viruses without realizing it. That is exactly why updating is the top priority if you run an affected version.

What kind of plugin is AI Engine

AI Engine is a plugin that lets a WordPress site add a whole set of AI features at once. It is developed by Jordy Meow, an engineer based in Japan, and his studio Meow Apps.

With the plugin installed, you can place an AI chatbot for inquiries on your site, have AI draft articles, or build AI-powered forms. Behind the scenes it connects to major AI services such as OpenAI (ChatGPT), Anthropic (Claude), Google, and Mistral, and because even the free version is feature-rich, it is widely used as a standard choice among WordPress AI plugins. It holds a 4.9-out-of-5 rating and is installed on more than 100,000 sites.

In recent years it has also invested heavily in supporting MCP (Model Context Protocol), a common standard that lets AI operate external tools and data. It can act as a bridge that lets an AI such as ChatGPT or Claude operate the contents of WordPress. As convenience grows, so does the number of doorways connecting to the outside world, and gaps in how those doorways are built lead to vulnerabilities like this one.

Why an administrator can be created without permission

The type of this vulnerability is technically called "Cross-Site Request Forgery (CSRF)." It is an attack technique that impersonates a logged-in user to make the site perform an action the user never intended.

Normally, when WordPress performs an important action, it checks a single-use token (a "nonce") every time to confirm the action really came from the user. But in AI Engine's authentication handling (internally named reauth_for_authorize), this token check was missing or insufficient. According to the NVD writeup, the attacker abuses a WordPress mechanism to convert a plain view request (GET) into a write request (POST) that looks as if the administrator sent it, and calls the API that creates a new user. The result is that an administrator account for the attacker gets created.

One important point: for the attack to succeed, it requires the extra step of getting a logged-in administrator to open the trap page. The CVSS assessment also classifies it as "user interaction required (UI:R)." This is not a wide-open hole that gets exploited with the attacker doing nothing. That said, because the attacker needs no account and only has to trick an administrator once, a classic email- or social-media-link lure is more than enough to pull it off. It is not light enough to ignore.

Affected versions and how to fix it

The fix is simple: update AI Engine to 3.6.6 or later. As of writing, the latest release is 3.6.7, which is also fine. You can update from the "Plugins" screen of the WordPress admin. If you haven't enabled automatic updates, apply the update manually as soon as you can.

After updating, it is a good idea to review the list of administrator accounts just in case. Open the "Users" screen in WordPress and check whether any unfamiliar administrator-level accounts have appeared. If you find an administrator you don't recognize or an account with an unnatural email address, delete it immediately and change the passwords of your existing administrators to be safe. Keeping plugins up to date is also a basic defense against attacks that target weaknesses in the open-source components (OSS) you pull in from outside.

Version 3.6.6 closes several holes at once

It is not only the admin-creation flaw that was fixed. The 3.6.6 release that Meow Apps published on July 30, 2026 bundles several security fixes. The published changes include the following items.

• Hardened the data entry point (REST API) so that externally supplied file paths and API keys are no longer accepted as-is
• Corrected route matching in MCP authentication (OAuth) to fix an issue that let authentication be bypassed
• Stopped guest session identifiers (cookies) from being rewritten from outside
• Stopped the chatbot key from being visible even to editor-level users

In other words, 3.6.6 is an update that closes several security weaknesses at once, including CVE-2026-15988. Rather than putting it off with "maybe my site isn't affected by this one CVE," it is safer to update if you are running an affected version.

AI Engine is a plugin with a steady stream of reports

AI Engine is convenient and popular, but it is also a plugin that has drawn repeated security reports over the past few years. Vulnerabilities around the entry points became especially noticeable after the MCP-related features that connect AI with the outside world were added. Here are the main ones disclosed in the past.

CVE-2025-11749, disclosed in October 2025, was a critical vulnerability with a severity of 9.8. According to reporting at the time, if the MCP "no-auth URL" feature was enabled, credentials could be read from the public API index and administrator access could be seized. That issue was fixed in 3.1.4. Detailed conditions for the past vulnerabilities can also be checked in the WPScan vulnerability database.

The developer ships a fixed release quickly each time an issue is reported, and that speed of response is itself well regarded. From a user's point of view, though, it is realistic to treat AI Engine as a plugin to use on the assumption that you keep it updated frequently rather than installing it and forgetting it. Enabling automatic updates makes such fixes harder to miss.

Exploitation status (confirmed vs. unconfirmed)

Here is what is known and what is not yet known, kept separate, as of writing. There is no need for excessive worry, but that is not a reason to leave an affected version alone either.

Whether a vulnerability is being actively exploited can be tracked on the Japanese-language dashboard of the CISA KEV catalog (a list of vulnerabilities known to be exploited). You can also check there whether CVE-2026-15988 gets listed in the future.

Summary

A vulnerability that lets an attacker secretly create an administrator account (CVE-2026-15988, CVSS 8.8) was found in versions of the popular WordPress AI plugin "AI Engine" up to 3.6.5, and a fixed release 3.6.6 is now out. The attacker needs no login, but success requires the extra step of luring an administrator to a trap page, so it is not a wide-open hole. Even so, because a mere trick can create a backdoor administrator, leaving it alone is out of the question for the more than 100,000 sites that use it.

There are only two things to do: update to 3.6.6 or later, and review your list of administrator accounts. AI Engine has had a steady stream of reports in the past, including a critical 9.8 vulnerability, so enabling automatic updates and keeping it current is the knack for getting along with this plugin. We will update this article if new developments appear, such as reports of exploitation or a KEV listing.

Sources

• ▸ NVD - CVE-2026-15988 Detail
• ▸ Wordfence Intelligence - AI Engine vulnerabilities
• ▸ WordPress.org - AI Engine plugin page
• ▸ Meow Apps - AI Engine official site
• ▸ Rapid7 - AI Engine CVE-2025-11749
• ▸ Cybersecurity News - AI Engine Plugin Exposes 100,000 WordPress Sites
• ▸ WPScan - AI Engine vulnerability database