100,000 WordPress Sites Affected by Privilege Escalation via MCP in AI Engine WordPress Plugin
100,000 WordPress Sites Affected by Privilege Escalation via MCP in AI Engine WordPress Plugin
Latest Reports: • WordPress Vulnerability Reports by Wordfence
Blog Post: https://www.wordfence.com/blog/2025/0...
🛡️ Get Wordfence: https://www.wordfence.com/products/pr...
🔵 Try Wordfence Central - https://www.wordfence.com/help/central/
⭐ Wordfence is Trusted by over 5 Million Websites
On May 21st, 2025, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for an Insufficient Authorization to Privilege Escalation via MCP (Model Context Protocol) vulnerability in the AI Engine plugin, which is actively installed on more than 100,000 WordPress websites. This vulnerability can be exploited by authenticated attackers, with subscriber-level access and above, to get full access to the MCP and execute various commands like ‘wp_update_user’, allowing them to escalate their privileges to administrators by updating their user role. Please note that this vulnerability only critically affects users who have enabled the Dev Tools and then the MCP module in the settings, which is disabled by default.
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on May 22, 2025. Sites using the free version of Wordfence will receive the same protection 30 days later on June 21, 2025.
We urge users to update their sites with the latest patched version of AI Engine, version 2.8.4 at the time of this writing, as soon as possible.
Read more in the full blog post: https://www.wordfence.com/blog/2025/0...
Stay informed and secure: read the full details and expert analysis on the Wordfence blog: https://www.wordfence.com/blog/
🔗 Get Wordfence today: https://www.wordfence.com/
🔐 Learn more about WordPress security: https://www.wordfence.com/learn/
🎥 Watch the full WordPress Security Essentials series here:
• WordPress Security Essentials by Wordfence...
Wordfence is designed for defense in depth by giving you a layered approach to security with our range of features.
#WordPress #WordPressSecurity #Cybersecurity #WebsiteProtection #Wordfence #OnlineSecurity #wordpress
===== Protect Your Site With Wordfence =====
✅ Get Wordfence Free: https://www.wordfence.com/products/wo...
✅ Get Wordfence Premium: https://www.wordfence.com/products/wo...
✅ Get Wordfence Care: https://www.wordfence.com/products/wo...
✅ Get Wordfence Response: https://www.wordfence.com/products/wo...
📝 Wordfence Audit Log:
All premium Wordfence plans include access to the Wordfence Audit Log — capturing, securely storing, and protecting important security events for forensic analysis.
🔵 Connect Your Sites To Wordfence Central:
https://www.wordfence.com/help/central/
Manage all your WordPress sites from one centralized dashboard.
💸 Want to earn money promoting Wordfence? Join the Wordfence Affiliate Program:
👉 Learn more: • How To Earn Money With The Wordfence Affil...
👉 Join: https://www.wordfence.com/affiliate
🐞 Earn money via our Bug Bounty Program:
Find vulnerabilities in WordPress plugins and themes and get rewarded!
👉 Join: https://www.wordfence.com/refer/youtube