CVE-2025-6238 - CVE House
Back to Database
Status published High CVE-2025-6238

AI Engine 2.8.4 - Insecure OAuth Implementation

Vulnerability Description

The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to intercept the authorization code and obtain an access token by redirecting the user to an attacker-controlled URI. Note: OAuth is disabled, the 'Meow_MWAI_Labs_OAuth' class is not loaded in the plugin in the patched version 2.8.5.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-6238

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • István Márton

References

More from tigroumeow

View All →
CVE-2025-8268
Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion
Medium 6.5
CVE-2025-8084
AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery
Medium 6.8
CVE-2025-7847
AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload
High 8.8
CVE-2025-7780
AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions
Medium 6.5
CVE-2025-6784
Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution
High 8.8

Affected Vendor

Affected Software

AI Engine
Vulnerable Versions:
2.8.4

Timeline

Official Publish: July 4th, 2025
Last Modified: July 8th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-601

MITRE ATT&CK TTPs

T1566 Phishing
Initial Access
T1204 User Execution
Execution
T1071 Application Layer Protocol
Command and Control
T1189 Drive-by Compromise
Initial Access
T1036 Masquerading
Defense Evasion