WordPress AI plugin flaw lets attackers hijack admin dashboard

A vulnerability in the AI Engine WordPress plugin, published by the US National Vulnerability Database on 1 October 2026, allows unauthenticated attackers to run arbitrary scripts in a site administrator's browser. The flaw, tracked as CVE-2026-96561, affects versions of the Meow Apps plugin up to and including 3.8.0. According to the NVD entry, the scripts execute whenever an administrator opens the WordPress dashboard.

The plugin markets itself as a chatbot, AI framework and MCP implementation for WordPress. MCP, the Model Context Protocol, is a standard for connecting AI models to tools and data.

What makes this bug notable is the route the attack takes. The NVD description sets out a chain of five weaknesses rather than a single coding mistake. It begins at the plugin's public chat endpoint, /mwai-ui/v1/chats/submit. That endpoint keeps a denylist of server parameters a caller is not allowed to set, including the AI model name. But the denylist only strips exact key names. A later function, convert_keys(), turns a submitted key such as 'model_' back into 'model', so the blocked value gets through anyway. An attacker can therefore place a string of their choosing, including carriage return and line feed characters, into the query's model field.

From there the string travels further than it should. A validation routine throws an exception whose message embeds the raw attacker string. In the non-streaming, non-admin code path, that exception message is written to the PHP error log without modification. Because the string can contain line breaks, the attacker can forge what looks like a genuine log entry.

The plugin then reads its own log. A helper function parses recent PHP errors, and the plugin's Advisor feature appends that content verbatim to the prompt it sends to an AI model. The NVD entry classifies this step as indirect prompt injection, catalogued as CWE-1427, where untrusted content reaching a model's prompt can steer its output. The model's reply comes back as JSON and is stored in the mwai_advisor_data option with no schema validation and no HTML sanitisation.

The final step is the dashboard. The Advisor widget takes the stored 'title' and 'description' values and concatenates them straight into the dashboard page without esc_html(), wp_kses() or any equivalent escaping function. The result is stored cross-site scripting, meaning the injected code is saved on the server and runs for every administrator who loads the page.

The NVD entry references specific lines in the plugin's published source for versions tagged 3.8.0, including the REST handler, the error-log helper, the Advisor module and the query base class. The record lists the issue as reported. The sources available do not state whether a fixed version has been released, and do not include any comment from Meow Apps.

The chain is a useful illustration of a problem that sits in many AI integrations. Each individual component behaves as its author presumably intended. The denylist filters a key. The error handler logs an error. The Advisor summarises logs. The widget displays a summary. The failure is that attacker-controlled text crosses from an unauthenticated public endpoint into a model prompt and then into a privileged admin page, and no stage along that route treats it as untrusted.