A critical security flaw in the AI Engine WordPress plugin allows unauthenticated attackers to intercept authorization codes through an insecure OAuth implementation.

The vulnerability involves an insecure OAuth implementation within the Meow_MWAI_Labs_OAuth class, where the redirect_uri parameter lacks necessary validation. This flaw allows an unauthenticated attacker to manipulate the authorization flow and potentially hijack user access tokens by redirecting traffic to a malicious URI.

Successful exploitation of this vulnerability could lead to the compromise of user accounts and sensitive data associated with the AI Engine plugin. Given the CVSS score of 8.0, this represents a high-severity risk that could facilitate unauthorized access and data exfiltration, ultimately damaging the integrity of the affected WordPress environment.

Immediate Action: Update the AI Engine plugin to version 2.8.5 or later, which removes the vulnerable OAuth functionality.

Proactive Monitoring: Audit WordPress logs for unusual redirect patterns or unexpected authentication requests originating from the AI Engine plugin directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests containing suspicious redirect_uri parameters until the update can be applied.

Public Exploit Available: Unknown

Organizations utilizing the AI Engine plugin must prioritize the update to version 2.8.5 immediately. Because the vulnerability involves sensitive OAuth authorization flows, leaving the system unpatched exposes users to potential credential and token theft, making rapid remediation essential to maintaining platform security.