The vulnerability arises from an unchecked 'model_' parameter in the AI Engine plugin’s chat submission endpoint. The input filtering mistakenly converts 'model_' to 'model', allowing an attacker to insert raw characters, including CR/LF, into the query. When the server throws an exception, the message containing that data is written unchanged to PHP’s error log. The plugin later parses the error log and returns its raw content into an AI prompt, which is stored without validation and rendered in the WordPress dashboard without escaping. As a result, an unauthenticated attacker can embed arbitrary JavaScript that will execute with the privileges of any administrator who views the dashboard, enabling cookie theft, credential hijacking, or further malicious actions.

The affected product is the AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin published by tigroumeow. All releases up to and including version 3.8.0 are vulnerable. Versions 3.8.1 and later contain the fix as indicated by the change set between those releases. Therefore, any WordPress site running the AI Engine plugin at a version ≤3.8.0 must be considered affected.

The CVSS score of 7.2 indicates a high impact if exploited. The absence of an EPSS score does not diminish the risk; the vulnerability can be triggered by a simple unauthenticated HTTP request to the /mwai-ui/v1/chats/submit REST endpoint. Because the payload ends up in a dashboard widget that is rendered in the administrator’s browser without escaping, the likelihood of a successful exploit is significant, especially if an attacker can target a site with active administrators. The vulnerability is not listed in the CISA KEV catalog, but the high impact and straightforward attack surface warrant prompt action.