The OAuth 2.1 Dynamic Client Registration endpoint is registered with a permission callback that always returns true, thus any unauthenticated user can register an OAuth client with a redirection URI controlled by the attacker. Once an administrator approves the client on the consent screen, the attacker receives an administrator‑bound MCP access token that grants full control over MCP tools, including user creation and option updates. The consent page is served without protective headers such as X-Frame-Options or CSP frame-ancestors, making it susceptible to clickjacking, which can further simplify the approval process. This flaw falls under the CWE-862 Missing Authorization.

The flaw is present in all releases of the Tigroumeow AI Engine – MCP Server & AI Chatbot for WordPress plugin up to and including version 3.8.6. WordPress sites that currently host that plugin and have not upgraded beyond 3.8.6 are vulnerable.

With a CVSS score of 7.5 the vulnerability presents a high impact, and although EPSS data is not available, the lack of proper authentication combined with clickjacking support suggests a realistic exploitation possibility. The workaround is not listed in CISA’s KEV catalog, indicating that no widespread exploitation has been confirmed. Nevertheless, the attack path requires only an unauthenticated HTTP request to the registration endpoint and the completion of the consent process by an existing administrator, making the risk significant for environments where the plugin is in use.