A critical privilege management flaw in the AI Engine plugin allows authenticated sub-site administrators to perform unauthorized account takeovers across the WordPress network.

This is an improper privilege management vulnerability (CWE-269) where the plugin fails to verify user authorization before executing privileged account operations. An attacker with existing Administrator privileges on a Multisite sub-site can exploit this to take over any account on the network, including the primary Network Administrator.

The ability for a sub-site administrator to hijack the Network Administrator account represents a total compromise of the WordPress multisite environment. Successful exploitation grants the attacker full control over the entire network, leading to unauthorized data access, potential site-wide defacement, and the installation of persistent backdoors. While the CVSS score is 7.2, the impact of a full network takeover necessitates immediate remediation to prevent complete administrative compromise.

Immediate Action: Update the AI Engine plugin to version 3.6.1 or later immediately to implement the required authorization checks.

Proactive Monitoring: Review WordPress user management logs and audit logs for suspicious account modifications or unexpected changes to administrative roles.

Compensating Controls: If patching is delayed, restrict administrative access to the WordPress dashboard and consider disabling the plugin on affected multisite installations until the update is applied.

Public Exploit Available: Unknown.

This vulnerability presents a severe risk to organizations utilizing WordPress Multisite configurations. Administrators must treat this as a priority update, as the flaw allows for the complete subversion of network-level security controls. Ensure that all instances of the AI Engine plugin are upgraded to version 3.6.1 without delay to mitigate the risk of unauthorized administrative account takeover.