What’s Vulnerable › Vulnerabilities
CVE-2026-75796: AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-21 · updated 2026-10-18
- Weakness: CWE-269
Description
The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.
Affected products
- AI Engine: from 2.8.0 before 3.6.1 — fixed in 3.6.1
How to fix
Upgrade to a fixed version: AI Engine 3.6.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-75796 or the next vulnerability affects your stack