CVE-2026-15988— AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match
Possible ATT&CK Techniques 3AI
T1059 · Command and Scripting Interpreter T1078 · Valid Accounts T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| tigroumeow | AI Engine – The Chatbot, AI Framework & MCP for WordPress | ≤ 3.6.5 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-15988
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match
Source: CVE Program / CVE List V5
Vulnerability Description
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauth_for_authorize function. This makes it possible for unauthenticated attackers to create new administrator accounts with attacker-supplied credentials via a CSRF-based REST authentication bypass, granted they can trick a site administrator into performing an action such as clicking on a link. This bypass can be combined with WordPress's ?_method=POST method-override support to convert a top-navigation GET request into an authenticated POST to the REST users endpoint, requiring no existing account on the attacker's part.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| tigroumeow | AI Engine – The Chatbot, AI Framework & MCP for WordPress | 0 ~ 3.6.5 | - |
II. Public POCs for CVE-2026-15988
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-15988
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-15988 (6)
Other References for CVE-2026-15988 (1)
IV. Related Vulnerabilities
- CVE-2026-8719
AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Esca - CVE-2026-1400
AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File - CVE-2026-0746
AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side - CVE-2025-8084
AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Req - CVE-2025-12844
AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object
Same vendor: tigroumeow
- CVE-2026-4912
Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticate - CVE-2025-6784
Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote C - CVE-2026-1291
Meow Gallery <= 5.4.4 - Missing Authorization to Authenticat - CVE-2026-8719
AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Esca - CVE-2026-1400
AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File
Same weakness: CWE-352
- CVE-2025-14469
Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modi - CVE-2025-67651
CSRF in PHP Jabbers scripts - CVE-2026-66416
Leantime CSRF Protection Globally Disabled by Omission of La - CVE-2026-28813
Apache JSPWiki: JSPWiki vulnerable to JSON hijacking - CVE-2026-44613
Apache Zeppelin: Cross-site request forgery in REST and WebS
V. Comments for CVE-2026-15988
No comments yet