Atomic Edge analysis of CVE-2026-65545: The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin, versions up to and including 3.6.8, contains an unauthenticated stored cross-site scripting (XSS) vulnerability in its MCP OAuth handling. The flaw arises from insufficient input sanitization and output escaping in the MCP OAuth login flow, enabling unauthenticated attackers to inject arbitrary web scripts that execute when an administrator or other user loads the affected page. This vulnerability carries a CVSS score of 7.2.
Root Cause: The vulnerability resides in the file ai-engine/labs/mcp-oauth.php. The vulnerable code path, starting at line 683, handles client secret validation for MCP OAuth token refresh requests. When the HTTP Authorization header is absent, the plugin falls back to reading credentials from PHP_AUTH_USER and PHP_AUTH_PW. However, the plugin fails to sanitize or escape the values obtained from these PHP server variables before using them in authentication logic or reflecting them in responses. Specifically, the plugin assigns the raw client_secret parameter or the PHP_AUTH_PW value to the $provided_secret variable without any validation, allowing an attacker to embed malicious script payloads in these fields. These payloads are later rendered without proper output escaping, leading to stored XSS.
Exploitation: An unauthenticated attacker can exploit this vulnerability by crafting a request to the MCP OAuth token endpoint, typically found at /wp-json/mwai/v1/mcp-oauth/token or a similar REST endpoint. The attacker sets the Authorization header to a malicious value containing the XSS payload, or sends a POST request with a crafted client_secret parameter. For example, the attacker could use a payload such as `client_secret=alert(document.cookie)`. Since the plugin does not sanitize or escape this value, the malicious script is stored and executed in the browser of any user who accesses the page where the value is reflected, including administrators.
Patch Analysis: The patch, applied in version 3.6.9, addresses the issue by adding a validation check for the PHP_AUTH_USER value. Specifically, the code now only trusts the PHP_AUTH_PW value if the PHP_AUTH_USER matches the expected client_id. This prevents an attacker from injecting arbitrary scripts through the PHP_AUTH_PW field when the username does not correspond to a valid client identifier. However, the patch does not appear to add direct sanitization or escaping for the $provided_secret variable itself; it only restricts the source of the data. Therefore, while the specific vector through PHP_AUTH_PW is mitigated, the underlying lack of output escaping remains a concern for other input paths, such as the client_secret parameter in the request body, which is still taken directly from the request without sanitization.
Impact: Successful exploitation allows an unauthenticated attacker to inject arbitrary JavaScript or other web scripts into the WordPress admin panel or any page where the reflected data is output. This can lead to session hijacking, deletion of posts, defacement, or complete site compromise if an administrator’s session is leveraged. Since the vulnerability is stored, the payload persists and executes on every page load for any user, significantly increasing the attack surface and potential damage.
