AI Engine WordPress Plugin Vulnerabilities: 3.6.6 Is Not Enough, Update to 3.7.1

A vulnerability that lets an attacker secretly create an administrator account, CVE-2026-15988 (CVSS 8.8), was disclosed in AI Engine, a popular plugin that adds AI chatbots and text generation to WordPress sites. This article was published on August 1, 2026 as coverage of that single issue, but in the 16 days since, four more CVEs have been disclosed, and one of them is not fixed in the 3.6.6 we originally recommended. We have therefore reworked this into an article that tracks AI Engine's vulnerabilities as a whole.

AI Engine is a go-to plugin used on more than 100,000 sites worldwide. According to the WordPress.org plugin page, it has 7,409,445 cumulative downloads and 858 ratings. Five CVEs were disclosed in the ten days from July 30 to August 8, 2026 alone, so the action you need now is not "update to 3.6.6" but "update to the latest 3.7.1." Apply the latest release from the developer, Meow Apps, from the WordPress admin screen.

Where each version stands as of August 2026

Start by checking what remains open in the version your site is running. The table covers the five CVEs disclosed between July 30 and August 8, 2026. You can check your AI Engine version number from the "Plugins" screen of the WordPress admin.

Technically, 3.6.9 or later closes all five of the vulnerabilities covered here. But the latest release is the simplest thing to tell readers, so this article recommends 3.7.1. It was released on August 14, 2026, and its changelog lists no security fixes, only a hardening-flavored change that limits how internal errors are shown ("Internal errors are now hidden behind a filterable public message").

The CVEs disclosed in 2026

Five CVEs for AI Engine were disclosed in the ten days from July 30 to August 8, 2026. Because there are so many, here they are as a list first. CVSS is a severity score out of 10, and CWE is a number that classifies the type of weakness.

The key point is that a newer disclosure date does not mean the issue is still open. CVE-2026-16953, 16954, and 16955 simply received their CVE numbers after CVE-2026-15988; the fixes themselves shipped earlier, in 3.6.4 and 3.6.6. The CNA (the organization that assigns CVE numbers) for all three is WPScan, and the reporter is Revanth Hari Narayana Matte. Sites already on 3.6.6 or later need no extra work for these three.

The remaining one is a different story.

CVE-2026-65545: the unauthenticated stored XSS that 3.6.6 does not fix

Of the five, CVE-2026-65545 alone is not fixed by the 3.6.6 this article originally pointed to. It affects 3.6.8 and below, meaning 3.6.6, 3.6.7, and 3.6.8 are all in scope, and the fixed release is 3.6.9, published on August 1, 2026. The CVE itself was disclosed on August 6, with Patchstack as the CNA and daroo, who reported it through the Patchstack bug bounty program, as the finder.

Stored cross-site scripting (XSS) is a flaw where a script sent in by an attacker is saved on the site and then runs when another user opens that screen. In AI Engine's case, the 3.6.9 entry in the WordPress.org changelog reads: "Stored chat messages could run scripts when an admin opened a discussion." A message sent to the chatbot is stored, and the script runs in the browser of the administrator who opens the conversation log in the admin screen.

Reading the CVSS vector: the attack works over the network (AV:N), the conditions are easy to meet (AC:L), the attacker needs no privileges (PR:N), but someone has to take an action (UI:R). Here that action is an administrator opening a conversation log, so the condition is met by a site owner simply using the admin screen as usual. The rating that the impact reaches beyond the plugin itself (S:C) is what pushes the score up to 7.1. If you run a public chatbot, do not stay below 3.6.9.

Overview of the vulnerability

From here on is the issue this article originally covered: CVE-2026-15988, the flaw that lets an administrator account be created without permission.

Details are published by the WordPress security firm Wordfence in its threat intelligence feed, and in the U.S. government vulnerability database NVD.

Who targets this, and what happens

The people who would exploit this hole are attackers who want to take over WordPress sites and use them for fraudulent ads, malware distribution, or as a springboard for phishing. The targets are any site still running an old version of AI Engine, regardless of size, whether it is a company site, a store site, or a personal blog.

What the attacker does is quietly get a site administrator to open a crafted trap link or page, so that a new administrator account for the attacker is created without the admin ever noticing. The attacker does not need to log in to the site at all. Tricking an administrator into opening the trap page just once is enough to add a hidden backdoor administrator.

Once an administrator account is in the attacker's hands, the site owner is exposed to everything from tampered posts and stolen data to newly planted malware. Ordinary visitors to the site can also be sent to fake login pages or made to download viruses without realizing it. That is exactly why updating is the top priority if you run an affected version.

What kind of plugin is AI Engine

AI Engine is a plugin that lets a WordPress site add a whole set of AI features at once. It is developed by Jordy Meow, an engineer based in Japan, and his studio Meow Apps.

With the plugin installed, you can place an AI chatbot for inquiries on your site, have AI draft articles, or build AI-powered forms. Behind the scenes it connects to major AI services such as OpenAI (ChatGPT), Anthropic (Claude), Google, and Mistral, and because even the free version is feature-rich, it is widely used as a standard choice among WordPress AI plugins. It holds a 4.9-out-of-5 rating and is installed on more than 100,000 sites.

In recent years it has also invested heavily in supporting MCP (Model Context Protocol), a common standard that lets AI operate external tools and data. It can act as a bridge that lets an AI such as ChatGPT or Claude operate the contents of WordPress. As convenience grows, so does the number of doorways connecting to the outside world, and gaps in how those doorways are built lead to vulnerabilities like this one.

Why an administrator can be created without permission

The type of this vulnerability is technically called "Cross-Site Request Forgery (CSRF)." It is an attack technique that impersonates a logged-in user to make the site perform an action the user never intended.

Normally, when WordPress performs an important action, it checks a single-use token (a "nonce") every time to confirm the action really came from the user. But in AI Engine's authentication handling (internally named reauth_for_authorize), this token check was missing or insufficient. According to the NVD writeup, the attacker abuses a WordPress mechanism to convert a plain view request (GET) into a write request (POST) that looks as if the administrator sent it, and calls the API that creates a new user. The result is that an administrator account for the attacker gets created.

One important point: for the attack to succeed, it requires the extra step of getting a logged-in administrator to open the trap page. The CVSS assessment also classifies it as "user interaction required (UI:R)." This is not a wide-open hole that gets exploited with the attacker doing nothing. That said, because the attacker needs no account and only has to trick an administrator once, a classic email- or social-media-link lure is more than enough to pull it off. It is not light enough to ignore.

Affected versions and how to fix it

[Correction] When first published, this article said that updating AI Engine to 3.6.6 or later was all that was needed. That guidance is no longer sufficient. Versions 3.6.6, 3.6.7, and 3.6.8 are affected by CVE-2026-65545, whose fixed release is 3.6.9. The correct action is to update to the latest 3.7.1. You can update from the "Plugins" screen of the WordPress admin. If you haven't enabled automatic updates, apply the update manually as soon as you can. The status of each version is summarized in the table earlier in this article, Where each version stands as of August 2026.

After updating, it is a good idea to review the list of administrator accounts just in case. Open the "Users" screen in WordPress and check whether any unfamiliar administrator-level accounts have appeared. If you find an administrator you don't recognize or an account with an unnatural email address, delete it immediately and change the passwords of your existing administrators to be safe. If you run a public chatbot, looking through the stored conversation logs at the same time gives you some reassurance regarding CVE-2026-65545 as well. Keeping plugins up to date is also a basic defense against attacks that target weaknesses in the open-source components (OSS) you pull in from outside.

Version 3.6.6 closes several holes at once

It is not only the admin-creation flaw that was fixed. The 3.6.6 release that Meow Apps published on July 30, 2026 bundles several security fixes. The published changes include the following items.

• Hardened the data entry point (REST API) so that externally supplied file paths and API keys are no longer accepted as-is
• Corrected route matching in MCP authentication (OAuth) to fix an issue that let authentication be bypassed
• Stopped guest session identifiers (cookies) from being rewritten from outside
• Stopped the chatbot key from being visible even to editor-level users

This sequence connects to the three CVEs disclosed later. The 3.6.5 entry in the changelog reads: "Three security issues reported by WPScan (key disclosure to editors, guessable guest sessions, audio transcription file read)." The changelog carries no CVE numbers, but those three descriptions read as the same issues as CVE-2026-16954 (information exposure), CVE-2026-16953 (broken authorization), and CVE-2026-16955 (path traversal), disclosed in August 2026. The numbers were assigned later; the fixes had already shipped.

In other words, 3.6.6 is an update that closes several security weaknesses at once, including CVE-2026-15988. As noted above, though, CVE-2026-65545 remains open in 3.6.6. Rather than putting it off with "maybe my site isn't affected by this one CVE," it is safer to go all the way to 3.7.1.

AI Engine is a plugin with a steady stream of reports

AI Engine is convenient and popular, but it is also a plugin that has drawn repeated security reports over the past few years. Counting the free version and Pro together, 33 CVEs have been published for it to date. Lined up by year, the growth in reports is visible.

At 13 through August 17, 2026 has already passed the previous year. Five of those landed in just ten days, from July 30 to August 8, 2026 (CVE-2026-15988 / 16954 / 65545 / 16953 / 16955). That concentration is why this article changed from a single-CVE writeup into one that tracks the plugin as a whole.

Of the 33, five are critical entries scoring 9.0 or above on CVSS.

• CVE-2023-51409 (CVSS 10.0)
• CVE-2025-11749 (CVSS 9.8)
• CVE-2024-34440 (CVSS 9.1)
• CVE-2024-29100 (CVSS 9.1)
• CVE-2026-23802 (CVSS 9.1)

Broken down by type, the reports also lean in particular directions. Here is the breakdown of the 33.

Among the main ones disclosed in the past, here are four whose impact is easy to picture.

CVE-2025-11749, disclosed in October 2025, was a critical vulnerability with a severity of 9.8. According to reporting at the time, if the MCP "no-auth URL" feature was enabled, credentials could be read from the public API index and administrator access could be seized. That issue was fixed in 3.1.4. Detailed conditions for the past vulnerabilities can also be checked in the WPScan vulnerability database and the Patchstack vulnerability database.

The developer ships a fixed release quickly each time an issue is reported, and that speed of response is itself well regarded. From a user's point of view, though, it is realistic to treat AI Engine as a plugin to use on the assumption that you keep it updated frequently rather than installing it and forgetting it. Enabling automatic updates makes such fixes harder to miss.

Why the reports keep coming for this plugin

Before writing the plugin off as "dangerous" based on the count alone, it is worth laying out what is actually going on, sticking to the facts. AI Engine adds AI features to WordPress. Placing a chatbot, generating articles, transcribing audio, and linking to external AI through MCP all boil down to the same building blocks: communication with external services, passing files around, and REST API endpoints.

Those three are, from an attacker's viewpoint, entry points. That is what the type breakdown above reflects, with six arbitrary file upload issues, four SSRF issues, and four information exposure issues. Code that talks to the outside gets examined for SSRF; code that handles files gets examined for arbitrary uploads and path traversal; endpoints callable from outside get examined for broken authorization. The more features there are, the wider the surface to inspect, and that relationship holds across software that deals with AI integrations.

At the same time, the speed of response after a report is also a matter of record. CVE-2026-65545 was disclosed on August 6, but the fixed release 3.6.9 had already shipped on August 1. The three issues reported by WPScan were closed in 3.6.4 and 3.6.6, ahead of their CVE disclosure. The changelog credits reporters by name, and the 3.7.0 entry follows that same practice. The number of vulnerabilities and how fast fixes reach users are two separate measures.

What you can do as a user is know the versions of the components you run and build a way to catch update notices. Having something that automatically surfaces vulnerabilities in the open-source components (OSS) your site depends on means that even when several CVEs land in a short window, as they did here, you can tell right away whether you are running an affected version.

Exploitation status (confirmed vs. unconfirmed)

Here is what is known and what is not yet known, kept separate, as of writing. There is no need for excessive worry, but that is not a reason to leave an affected version alone either.

As a gauge of how likely exploitation is, there is also EPSS, which estimates the probability that a vulnerability will actually be exploited within the next 30 days. All five here score low.

The last row is there for comparison. CVE-2025-11749 from October 2025 sits at EPSS 0.74759 (99.46th percentile), an order of magnitude apart, and even that is not on the KEV catalog. The five covered here are two orders of magnitude below it. On the numbers, this is not a moment that calls for emergency measures beyond updating.

Note that the phrase Patchstack attaches to CVE-2026-65545, "moderately dangerous and expected to become exploited," is the generic assessment wording the company applies to the nature of a vulnerability. It does not mean exploitation has been observed. Assessment wording and attack observation reports need to be read as separate things.

Whether a vulnerability is being actively exploited can be tracked on the Japanese-language dashboard of the CISA KEV catalog (a list of vulnerabilities known to be exploited). You can also check there whether any of these five get listed in the future.

Coverage in Japan

As for official Japanese sources, no registration in JVN iPedia has been confirmed. No advisories from JPCERT/CC or IPA have been issued either. AI Engine is used in Japan as well, so waiting for an announcement from a public body risks delaying your update.

Japanese technical media, on the other hand, have covered this run of vulnerabilities. Mynavi's TECH+ piece "40 WordPress vulnerabilities, half exploitable without authentication; AI Engine allows administrator account creation (July 30 to August 5)" (August 14, 2026) covers CVE-2026-15988 within its weekly roundup, and KUSANAGI's "WordPress theme and plugin vulnerability roundup (2026/07/30-2026/08/05)" organizes the plugin vulnerabilities from the same period. No standalone Security NEXT article on AI Engine has been confirmed.

Numbers differ slightly between outlets. KUSANAGI lists the CVSS for CVE-2026-65545 as 7.2, while NVD and Patchstack both put it at 7.1. This article uses 7.1. Either way it lands in the "High" band, and the response (update to 3.6.9 or later) is the same.

Summary

Five CVEs for the popular WordPress AI plugin "AI Engine" were disclosed in the ten days from July 30 to August 8, 2026. The central one is CVE-2026-15988 (CVSS 8.8), which lets an attacker have an administrator account created for them. This article originally said "update to 3.6.6," but CVE-2026-65545 (CVSS 7.1, unauthenticated stored XSS), disclosed afterwards, affects 3.6.8 and below and is not fixed in 3.6.6. The version to update to is the latest, 3.7.1.

There are two things to do: update to 3.7.1, and review your list of administrator accounts. The other three (CVE-2026-16953 / 16954 / 16955) only received their CVE numbers later; the fixes shipped earlier in 3.6.4 and 3.6.6, so updated sites need no extra work. On exploitation, there is no KEV listing, no public proof-of-concept code, and no report of actual attacks. The EPSS scores for all five are low.

AI Engine has 33 published CVEs in total, 13 of them in 2026 alone. Given the breadth of its attack surface across external communication, file handling, and REST APIs, the realistic way to run this plugin is to enable automatic updates and stay on the latest version. We will add to this article if new CVEs are disclosed or reports of exploitation appear.

Sources

• ▸ NVD - CVE-2026-15988 Detail
• ▸ NVD - CVE-2026-65545 Detail
• ▸ Patchstack - AI Engine vulnerability database
• ▸ Wordfence Intelligence - AI Engine vulnerabilities
• ▸ WPScan - AI Engine vulnerabilities
• ▸ WordPress.org - AI Engine plugin page (changelog, install count)
• ▸ Meow Apps - AI Engine official site
• ▸ FIRST - EPSS (Exploit Prediction Scoring System)
• ▸ CISA - Known Exploited Vulnerabilities Catalog
• ▸ Mynavi TECH+ - WordPress vulnerabilities roundup (July 30 to August 5)
• ▸ KUSANAGI - WordPress theme and plugin vulnerability roundup (2026/07/30-2026/08/05)
• ▸ Rapid7 - AI Engine CVE-2025-11749
• ▸ Cybersecurity News - AI Engine Plugin Exposes 100,000 WordPress Sites
• ▸ WPScan - AI Engine vulnerability database

Revision History

• ▸ August 17, 2026: Reworked from a single-CVE writeup into an article that tracks AI Engine's vulnerabilities as a whole. Correcting the original guidance that updating to 3.6.6 completed the response. CVE-2026-65545 (CVSS 7.1, unauthenticated stored XSS), disclosed afterwards, affects 3.6.8 and below and is not fixed in 3.6.6, 3.6.7, or 3.6.8. The recommended target has been changed from 3.6.6 to the latest 3.7.1. Also added: CVE-2026-16953 / 16954 / 16955 disclosed in August 2026 (all already fixed in 3.6.4 and 3.6.6), a per-version status table, statistics on all 33 CVEs, exploitation checks against EPSS and CISA KEV, and coverage by Japanese media.
• ▸ August 1, 2026: First published (CVE-2026-15988, CVSS 8.8, fixed in 3.6.6).