News & Articles

Over 100K Websites Hit by AI Engine WordPress Plugin Flaw

On October 4, 2025, security researcher Emiliano Versini reported a critical flaw in the AI Engine WordPress Plugin to the Wordfence Threat Intelligence team. The report detailed a privilege escalation vulnerability that affected version 3.1.3 and earlier. This issue has potentially exposed more than 100,000 WordPress websites to attacks.

According to the report, the vulnerability was linked to the plugin’s REST API configuration when the “No-Auth URL” feature was enabled. It exposed a bearer token that could be used by attackers to gain admin-level access. Exploiting this flaw allowed unauthorized users to modify site settings or create new administrator accounts.

This issue was identified as CVE-2025-11749 with a CVSS score of 9.8 (Critical). The plugin developer released version 3.1.4 to patch the vulnerability. Users who have not updated remain exposed to potential exploitation.

Here’s the complete timeline:

What This Vulnerability Means for Your Business

Now, the AI Engine WordPress Plugin flaw is not just a coding issue. It can directly affect how your business operates and how customers perceive your brand. Attackers gaining administrative access can cause widespread damage that extends beyond your website.

• Data Breach and Information Theft

Attackers who gain admin access can extract sensitive data, including client records and payment details. This exposure increases the risk of fraud and non-compliance with data protection laws.

• Website Defacement and Malware Injection

Hackers may alter site content or add malicious scripts. These intrusions can mislead visitors, spread malware, and damage your brand’s credibility.

• Operational Downtime and Financial Loss

Unauthorized access can disrupt transactions or disable key site features. Downtime affects customer experience and leads to lost sales and reduced business efficiency.

• Search Engine and Reputation Damage

Search engines often blacklist compromised websites, resulting in lower visibility and lost organic traffic. Recovering SEO performance and trust can take significant time and resources.

• Multi-Site and Agency-Level Exposure

For businesses or agencies managing several WordPress sites, the threat multiplies. A single unpatched plugin can compromise multiple client websites, creating larger-scale disruptions.

Strong website security protects your digital assets, customer trust, and long-term business growth. Updating the affected plugin and reinforcing defenses should be an immediate priority.

Essential Security Actions for Affected Websites

Addressing the AI Engine WordPress Plugin vulnerability requires prompt and deliberate action. These steps help businesses secure their websites, protect data, and maintain system integrity.

1. Update to the Latest Plugin Version

Immediately install version 3.1.4 or higher of the AI Engine WordPress Plugin. The update patches the privilege escalation flaw and restores secure functionality. Also, regularly check for plugin updates to ensure vulnerabilities are fixed before attackers can exploit them.

2. Review User Accounts and Permissions

Audit all registered user accounts, focusing on administrative roles. It’s also best to remove unauthorized users and reset passwords where necessary. Consistently access monitoring to help detect unusual activities early and prevents privilege misuse.

3. Disable the “No-Auth URL” Feature

If your site uses this setting, disable it to prevent token exposure. This configuration is a key factor in the vulnerability, allowing attackers to bypass authentication controls.

4. Rotate Tokens and Credentials

Assume previously exposed tokens are compromised, replace them immediately and generate new, secure tokens. Rotating tokens reduces the chance of reused access by unauthorized parties.

5. Conduct Regular Security Audits

Outdated or poorly maintained software often introduces vulnerabilities. So, schedule periodic reviews of plugins, themes, and integrations. Audits also help identify risks early, allowing faster and more cost-effective resolutions.

6. Strengthen Monitoring and Firewalls

Enable web application firewalls and intrusion detection systems. These tools can block suspicious REST API requests or brute-force attempts. Plus, pairing active monitoring with automatic alerts enhances visibility and response time.

7. Partner with Security Experts

If your team lacks technical expertise, consider partnering with a professional web security provider. Experts can implement protective measures, ensure compliance, and provide timely updates for your WordPress ecosystem.

Final Thoughts

As cyber threats continue to evolve, the AI Engine WordPress Plugin incident serves as a crucial reminder for all website owners. Even trusted and widely used plugins can expose vulnerabilities if left unchecked.

The AI Engine WordPress Plugin vulnerability highlights the importance of proactive website security. Regular updates, audits, and monitoring are essential to protect your business from data breaches and downtime.

For dependable website protection and maintenance, Syntactics, Inc. provides expert WordPress development services. Our team ensures your site remains secure, optimized, and resilient to digital threats while supporting your long-term growth. Secure your WordPress site today.

FAQs About AI Engine WordPress Plugin

What caused the AI Engine WordPress Plugin vulnerability?

The issue came from how the plugin’s REST API handled the “No-Auth URL” feature, which exposed bearer tokens attackers could exploit for admin access.

Which versions of the AI Engine plugin were affected?

All versions up to 3.1.3 contained the flaw. Users must update to version 3.1.4 or later to stay protected.

How can businesses confirm if their website was compromised?

Check your site’s access logs for unusual activity, such as new admin accounts or REST API requests from unknown sources. It’s best to get in touch with trusted WordPress experts for strategic solutions.