AI Engine - Information Disclosure (CVE-2025-11749)
Description
The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract the bearer token, which can be used to gain access to a valid session and perform many actions like creating a new administrator account, leading to privilege escalation.
psychologyCrowdSec Analysis
CVE-2025-11749 is a critical vulnerability in the AI Engine WordPress plugin that exposes sensitive bearer tokens through the /mcp/v1/ REST API endpoint when 'No-Auth URL' is enabled. This flaw allows unauthenticated attackers to extract valid session tokens, potentially leading to privilege escalation, such as creating new administrator accounts and taking full control of the affected WordPress site.
CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.
CrowdSec network observations suggest that most exploitation of CVE-2025-11749 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2025-11749 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Attackers exploit unauthenticated requests to the /wp-json/mcp/v1 REST API endpoint, which exposes sensitive bearer tokens and related information when the No-Auth URL feature is enabled in the AI Engine WordPress plugin.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-11-05 |
| Rule Released | 2025-11-26 |
| CrowdSec First Seen | 2025-11-27 |