{"vulnerability": "cve-2025-11749", "sightings": [{"uuid": "dda510f9-4447-4fb3-b916-e124b9d5312f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11749", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m5z5n7djxd2g", "content": "", "creation_timestamp": "2025-11-19T21:02:38.285954Z"}, {"uuid": "13405174-d1fc-4460-813a-1c4fa1aaef94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11749", "type": "seen", "source": "https://bsky.app/profile/crowdcyber.bsky.social/post/3m4vmw4s47j2o", "content": "", "creation_timestamp": "2025-11-05T18:00:11.171843Z"}, {"uuid": "cbf0631f-4da6-4c88-ae32-6d764cdfac02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11749", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-11749.yaml", "content": "", "creation_timestamp": "2025-11-11T13:52:25.000000Z"}, {"uuid": "7de4a1f7-1d22-4d35-8f6a-89bb5a99e358", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11749", "type": "seen", "source": "https://gist.github.com/Darkcrai86/5ab8c8bddb9e8b895b9fb30eb97aebd5", "content": "", "creation_timestamp": "2025-11-04T18:16:51.000000Z"}, {"uuid": "547be7ad-74ac-4c3b-9a23-2fcec413850a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-11749", "type": "seen", "source": "https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m4uakng6iea2", "content": "", "creation_timestamp": "2025-11-05T04:47:13.164917Z"}, {"uuid": "0e81d1b3-3fce-445b-bbfa-f677fbb83b48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-11749", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3m4uereeu2s26", "content": "", "creation_timestamp": "2025-11-05T06:01:42.486486Z"}, {"uuid": "dcb072fc-3b1f-4b9e-be1c-2ae141cfa73a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11749", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3m4uevubuew2q", "content": "", "creation_timestamp": "2025-11-05T06:04:12.508745Z"}, {"uuid": "39919886-7de9-4a55-ba11-714aaad2510c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11749", "type": "seen", "source": "https://gist.github.com/BilalGns/a8a87aea7bc6a4524a4a09b526ca3ee4", "content": "", "creation_timestamp": "2025-11-11T16:30:25.000000Z"}, {"uuid": "9039fedf-d46f-4627-a6b8-6b9b37f47a5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11749", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m7bf3pelyq2g", "content": "", "creation_timestamp": "2025-12-05T21:02:29.825319Z"}, {"uuid": "5fd67010-cd60-4a92-bef3-a8bbf4291065", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11749", "type": "published-proof-of-concept", "source": "Telegram/PAMdmLREvkvF-ZRN4h7yWGEu1Ru8d6xArs28PQPSzHDez6o", "content": "", "creation_timestamp": "2025-11-08T09:00:05.000000Z"}, {"uuid": "8d97076f-4b8c-4090-a2b8-d797b51d0612", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11749", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"Emiliano Versini\", \"Khaled Alenazi (Nxploited)\", \"Valentin Lobstein \", \"dledda-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated vulnerability in the WordPress AI Engine plugin\\n          (versions <= 3.1.3). The vulnerability allows an attacker to create an administrator account\\n          via the MCP (Model Context Protocol) endpoint without authentication. The module supports\\n          both `/wp-json/mcp/v1/` and `/?rest_route=/mcp/v1/` endpoints. Once an administrator\\n          account is created, the module uploads and executes a malicious plugin to achieve remote\\n          code execution (RCE).\", \"disclosure_date\": \"2025-11-04\", \"fullname\": \"exploit/multi/http/wp_ai_engine_mcp_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:04 +0000\", \"name\": \"WordPress AI Engine Plugin MCP Unauthenticated Admin Creation to RCE\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/wp_ai_engine_mcp_rce\", \"references\": [\"CVE-2025-11749\", \"URL-https://github.com/Nxploited/CVE-2025-11749\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP In-Memory\", \"Unix/Linux Command Shell\", \"Windows Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:20.506875Z"}, {"uuid": "80edac7d-a4f4-42e3-a206-293f638eaf5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11749", "type": "seen", "source": "https://t.me/Intel_Encyclopedia/1668", "content": "\u2728 General Cyber News \u2728\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 AI Engine \u0434\u043b\u044f WordPress \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 100 000 \u0441\u0430\u0439\u0442\u043e\u0432\n\n\u2014\n\nSummary:\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u043b\u0430\u0433\u0438\u043d\u0435 AI Engine \u0434\u043b\u044f WordPress, \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u0433\u0440\u043e\u0437\u0443 \u0434\u043b\u044f \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 100 000 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430. \u0414\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043a\u0430\u043a CVE-2025-11749 \u0441 \u0440\u0435\u0439\u0442\u0438\u043d\u0433\u043e\u043c CVSS 9.8 (\u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439),...\n\n\u2014\n\nSource: SEC-1275-1\nPublished: 2025-11-06 17:14 | Author: Vulner Queen\n\n#general_cyber_news #engine #wordpress\n\nhttps://1275.ru/vulnerability/uyazvimost-v-plagine-ai-engine-dlya-wordpress-stavit-pod-ugrozu-100-000-saytov_16049", "creation_timestamp": "2026-09-09T05:00:16.572294Z"}, {"uuid": "d6e71d9f-0243-48a2-9e78-e746f2fa322d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-11749", "type": "seen", "source": "https://t.me/Intel_Encyclopedia/1668", "content": "\u2728 General Cyber News \u2728\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 AI Engine \u0434\u043b\u044f WordPress \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 100 000 \u0441\u0430\u0439\u0442\u043e\u0432\n\n\u2014\n\nSummary:\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u043b\u0430\u0433\u0438\u043d\u0435 AI Engine \u0434\u043b\u044f WordPress, \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u0433\u0440\u043e\u0437\u0443 \u0434\u043b\u044f \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 100 000 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0442\u043e\u043a\u0435\u043d\u044b \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430. \u0414\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043a\u0430\u043a CVE-2025-11749 \u0441 \u0440\u0435\u0439\u0442\u0438\u043d\u0433\u043e\u043c CVSS 9.8 (\u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439),...\n\n\u2014\n\nSource: SEC-1275-1\nPublished: 2025-11-06 17:14 | Author: Vulner Queen\n\n#general_cyber_news #engine #wordpress\n\nhttps://1275.ru/vulnerability/uyazvimost-v-plagine-ai-engine-dlya-wordpress-stavit-pod-ugrozu-100-000-saytov_16049", "creation_timestamp": "2026-09-10T00:00:34.823219Z"}]}