The advisory for WordPress AI Engine describes an MCP OAuth flow in which dynamic client registration and a frameable consent page enabled a client to seek authority beyond an ordinary low-privilege tool operation. The browser UI was part of the authorization path: a user’s apparent consent could be steered while the registration context and requested…
Inspect the ClaimsCase · DiggingBeagle record
WordPress AI Engine MCP OAuth consent could be framed into broader authority
An OAuth dynamic-registration and consent UI problem could grant unintended administrative scope to a client.
Scope
An AI Engine WordPress MCP OAuth feature with dynamic registration and consent conditions; deployment settings and observed victim population are not verified here.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
The advisory describes a tool-authorization escalation path; the evidence here does not establish confirmed sites compromised or a reviewed fixed version. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-WP-AI-ENGINE-MCP-OAUTH-1 · WordPress AI Engine MCP OAuth registration and consent advisory
At a glance
The path requires a registration, browser/consent interaction and grant; it does not imply automatic administrator access on all WordPress sites.
Read the implicationsThe prevalence of vulnerable consent settings is unknown. No confirmed instance-wide takeover attributable to this flaw was reported.
Limits and uncertaintyFull account
The advisory for WordPress AI Engine describes an MCP OAuth flow in which dynamic client registration and a frameable consent page enabled a client to seek authority beyond an ordinary low-privilege tool operation. The browser UI was part of the authorization path: a user’s apparent consent could be steered while the registration context and requested scopes were not adequately constrained. This is not equivalent to possessing administrator access automatically; client registration, interaction and token issuance must align for the exploit path.
MCP is relevant because the resulting token could authorize assistant tools against a WordPress installation. A regression test should verify client identity, redirect binding, consent framing protections, and the exact scopes granted after completion. The vulnerability does not establish that any particular WordPress site was compromised or that the model autonomously selected the malicious client.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-WP-AI-ENGINE-MCP-OAUTH-1The GitHub advisory identifies OAuth client-registration and consent framing conditions that can overgrant authority in WordPress AI Engine MCP integration.supported
Basis: reported finding
- supportsWordPress AI Engine MCP OAuth registration and consent advisoryprimary disclosure
GHSA-22w7-p44p-2gq7, OAuth registration, consent framing and scope details
Implications
The path requires a registration, browser/consent interaction and grant; it does not imply automatic administrator access on all WordPress sites.
Controls and mitigations
- Bind redirect URIs and client identity, enforce anti-framing protections, limit scopes and verify grants using independent browser tests.
Unknowns and contradictions
- The prevalence of vulnerable consent settings is unknown.
- No confirmed instance-wide takeover attributable to this flaw was reported.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208