Description
CVE-2025-11749 是 WordPress AI Engine 插件的高危漏洞，影响 3.1.3 及以下版本，波及超 10 万活跃安装。漏洞导致 MCP 协议令牌泄露，攻击者可借此提权获取管理员权限，对网站安全构成严重威胁。
WordPress AI Engine /wp-json/mcp/v1 信息泄露漏洞（CVE-2025-11749）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-11749
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ai-engine/ai-engine-313-unauthenticated-sensitive-information-exposure-to-privilege-escalation
https://www.sentinelone.com/vulnerability-database/cve-2025-11749/
https://zeropath.com/blog/cve-2025-11749-ai-engine-wordpress-plugin
https://adg.csdn.net/69708de0437a6b40336aae54.html
https://wpscan.com/vulnerability/b0d583a2-14e1-40bc-b875-3b48e992b803/
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-11749.yaml