Is CVE-2026-15988 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15988 being exploited in the wild.

How severe is CVE-2026-15988?

High severity, with a CVSS score of 8.8, published 1 August 2026.

Is there a fix for CVE-2026-15988?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15988 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15988?

Check whether you run Meow Apps AI Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15988: Meow Apps AI Engine CSRF-based auth bypass in reauth_for_authorize

CVE-2026-15988 · Severity: high · CVSS 8.8 · Published 2026-08-01

The AI Engine plugin for WordPress, which provides chatbot and AI framework capabilities, is vulnerable to a security flaw that allows attackers to take over a website. By tricking a site administrator into clicking a malicious link, an attacker can bypass authentication and create a new administrator account for themselves. This gives the attacker full control over the website, potentially leading to data theft, site defacement, or complete service disruption.

Technologies: Meow Apps AI Engine. Vendors: Meow Apps.

Quick answers

Is CVE-2026-15988 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15988 being exploited in the wild.
How severe is CVE-2026-15988?: High severity, with a CVSS score of 8.8, published 1 August 2026.
Which products and versions are affected?: Meow Apps AI Engine <= 3.6.5.
Is there a fix for CVE-2026-15988?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15988 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15988?: Check whether you run Meow Apps AI Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The AI Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the 'reauth_for_authorize' function in versions up to and including 3.6.5. This vulnerability allows unauthenticated attackers to bypass REST authentication. By leveraging WordPress's '?_method=POST' method-override support, an attacker can convert a GET request (triggered via social engineering, such as a link click by an administrator) into an authenticated POST request to the REST users endpoint. This enables the creation of a new administrator account with attacker-supplied credentials. The issue is addressed in version 3.6.6.

Affected products

tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.6.5

Timeline

2026-08-01: advisory: NVD publication date
2026-08-01: disclosed: Wordfence disclosure date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.