CVE-2025-11749: AI Engine WordPress Information Disclosure

CVE-2025-11749 Overview

CVE-2025-11749 is a critical Sensitive Information Exposure vulnerability affecting the AI Engine plugin for WordPress in all versions up to and including 3.1.3. The vulnerability exists in the /mcp/v1/ REST API endpoint, which inadvertently exposes the Bearer Token value when the "No-Auth URL" feature is enabled. This exposure allows unauthenticated attackers to extract authentication tokens remotely, enabling session hijacking and privilege escalation attacks.

Critical Impact

Unauthenticated attackers can extract Bearer tokens via the REST API to hijack sessions and create administrator accounts, resulting in complete site compromise.

Affected Products

• AI Engine plugin for WordPress versions up to and including 3.1.3
• WordPress sites with AI Engine plugin installed and "No-Auth URL" feature enabled
• Any WordPress installation using vulnerable AI Engine MCP REST API functionality

Discovery Timeline

• 2025-11-05 - CVE-2025-11749 published to NVD
• 2025-11-06 - Last updated in NVD database

Technical Details for CVE-2025-11749

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw resides in how the AI Engine plugin handles authentication tokens within its MCP (Machine Communication Protocol) REST API implementation. When the "No-Auth URL" configuration option is enabled, the plugin's /mcp/v1/ endpoint returns the Bearer Token in API responses without proper access controls.

The vulnerability is particularly dangerous because it requires no authentication to exploit and can be accessed over the network. An attacker who successfully extracts the Bearer token can use it to authenticate as a legitimate user, bypass authentication mechanisms, and perform privileged operations including the creation of new administrator accounts.

Root Cause

The root cause of this vulnerability lies in improper access control logic within the mcp.php file of the AI Engine plugin. When the "No-Auth URL" feature is enabled, the code path that handles REST API requests fails to adequately protect sensitive authentication credentials. The Bearer Token, which should be treated as a confidential secret, is included in API responses accessible to unauthenticated users.

The vulnerable code can be reviewed in the WordPress Plugin Code Review where the token exposure occurs.

Attack Vector

The attack vector is network-based and requires no user interaction or prior authentication. An attacker can exploit this vulnerability by:

1. Identifying Target Sites: Scanning for WordPress installations with the AI Engine plugin active
2. Probing the Endpoint: Sending requests to the /mcp/v1/ REST API endpoint
3. Token Extraction: Capturing the exposed Bearer Token from API responses when No-Auth URL is enabled
4. Session Hijacking: Using the extracted token to authenticate to the WordPress site
5. Privilege Escalation: Creating a new administrator account or performing other privileged operations

The vulnerability mechanism involves the REST API endpoint returning sensitive authentication data. When an attacker sends a crafted request to the /mcp/v1/ endpoint on a vulnerable site, the response includes the Bearer Token if the No-Auth URL configuration is enabled. This token can then be replayed to gain authenticated access. For technical implementation details, see the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-11749

Indicators of Compromise

• Unexpected HTTP requests to /mcp/v1/ REST API endpoints from external IP addresses
• Anomalous API response patterns containing token data in server logs
• Creation of new administrator accounts without legitimate administrative action
• Unusual authentication events using Bearer token authentication from unfamiliar IP addresses
• Evidence of reconnaissance scanning targeting WordPress REST API endpoints

Detection Strategies

• Monitor web server access logs for repeated requests to /wp-json/mcp/v1/ or similar MCP endpoints
• Implement Web Application Firewall (WAF) rules to detect and alert on suspicious REST API access patterns
• Deploy intrusion detection signatures for token extraction attempts against WordPress sites
• Enable WordPress audit logging to track administrator account creation events
• Use SentinelOne Singularity to detect post-exploitation activities following successful token theft

Monitoring Recommendations

• Configure real-time alerting for new administrator account creation in WordPress
• Establish baseline metrics for REST API endpoint access and alert on anomalies
• Monitor for lateral movement or persistence mechanisms following potential compromise
• Review authentication logs for Bearer token usage from unexpected sources
• Implement network traffic analysis to detect token exfiltration attempts

How to Mitigate CVE-2025-11749

Immediate Actions Required

• Update the AI Engine plugin to the latest patched version immediately
• Disable the "No-Auth URL" feature if it is currently enabled until patching is complete
• Rotate all existing Bearer tokens and API credentials associated with the AI Engine plugin
• Audit administrator accounts for any unauthorized additions
• Review access logs for evidence of exploitation prior to patching

Patch Information

The vulnerability has been addressed in versions of the AI Engine plugin released after 3.1.3. The fix can be reviewed in the WordPress Changeset Update which modifies the token handling logic in the MCP REST API implementation.

WordPress site administrators should update the AI Engine plugin through the WordPress admin dashboard or by manually downloading the latest version from the WordPress plugin repository. After updating, verify the new version is active and confirm that sensitive endpoints no longer expose authentication tokens.

Workarounds

• Disable the AI Engine plugin entirely until a patch can be applied if immediate updating is not possible
• Use web server configuration to block access to /wp-json/mcp/v1/ endpoints from untrusted networks
• Implement IP allowlisting for REST API access to limit exposure to known administrative IP addresses
• Deploy a WAF rule to inspect and block requests targeting the vulnerable endpoint

# Apache .htaccess workaround to block MCP endpoint access
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-json/mcp/v1/ [NC]
    RewriteRule .* - [F,L]
</IfModule>