CVE-2025-6238

HIGH

WordPress AI Engine <2.8.4 - Open Redirect

Title source: llm
STIX 2.1

Description

The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to intercept the authorization code and obtain an access token by redirecting the user to an attacker-controlled URI. Note: OAuth is disabled, the 'Meow_MWAI_Labs_OAuth' class is not loaded in the plugin in the patched version 2.8.5.

Scores

CVSS v3 8.0
EPSS 0.0030
EPSS Percentile 21.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-601
Status published
Products (1)
meowapps/ai_engine 2.8.4
Published Jul 04, 2025
Tracked Since Feb 18, 2026