Flaw in AI Engine Plugin Exposes WordPress Sites to Full Compromise

EXECUTIVE SUMMARY:

A critical vulnerability CVE‑2025‑11749, CVSS 9.8 has been discovered in the popular AI Engine WordPress plugin versions up to 3.1.3 that allows unauthenticated attackers to expose a bearer token via the plugin’s “No-Auth URL” REST API endpoints and then leverage it to escalate privileges and compromise the site entirely — including upgrading a user to administrator, injecting malicious code, or installing back-doors.