https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 20:43:47 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-281519 EUVD-2026-281519 https://cve.radiocsirt.org/vuln/euvd-2026-281519 https://cve.radiocsirt.org/vuln/fkie_cve-2025-11749 <p>The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the &#39;Bearer Token&#39; value when &#39;No-Auth URL&#39; is enabled. This makes it possible for unauthenticated attackers to extract the bearer token, which can be used to gain access to a valid session and perform many actions like creating a new administrator account, leading to privilege escalation.</p> <p>The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the &#39;Bearer Token&#39; value when &#39;No-Auth URL&#39; is enabled. This makes it possible for unauthenticated attackers to extract the bearer token, which can be used to gain access to a valid session and perform many actions like creating a new administrator account, leading to privilege escalation.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-11749 https://cve.radiocsirt.org/vuln/ghsa-q6x7-qqgq-h832 <p>The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the &#39;Bearer Token&#39; value when &#39;No-Auth URL&#39; is enabled. This makes it possible for unauthenticated attackers to extract the bearer token, which can be used to gain access to a valid session and perform many actions like creating a new administrator account, leading to privilege escalation.</p> <p>The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the &#39;Bearer Token&#39; value when &#39;No-Auth URL&#39; is enabled. This makes it possible for unauthenticated attackers to extract the bearer token, which can be used to gain access to a valid session and perform many actions like creating a new administrator account, leading to privilege escalation.</p> https://cve.radiocsirt.org/vuln/ghsa-q6x7-qqgq-h832