A critical security vulnerability in the AI Engine WordPress plugin has put more than 100,000 active installations at risk of privilege escalation attacks.

The flaw, tracked as CVE-2025-11749 with a CVSS score of 9.8, allows unauthenticated attackers to extract bearer tokens and gain complete administrative control over vulnerable WordPress sites.

Security researcher Emiliano Versini discovered the vulnerability on October 4, 2025, and responsibly reported it through the Wordfence Bug Bounty Program, earning a bounty of $2,145.

The vulnerability centers on a sensitive information exposure issue that affects all versions of AI Engine up to and including 3.1.3.

When site administrators enable the ‘No-Auth URL’ feature in the Model Context Protocol (MCP) settings, the plugin inadvertently exposes bearer tokens through the /wp-json/ REST API index.

These tokens serve as authentication credentials for the MCP integration, which enables AI agents like Claude and ChatGPT to control WordPress websites by executing commands, managing media files, and editing user accounts.

Wordfence researchers identified the root cause in the plugin’s REST API route registration process.

The vulnerable code registers No-Auth URL endpoints without setting the ‘show_in_index’ parameter to false, making these endpoints publicly accessible.

Once attackers extract the exposed bearer token from the API index, they can authenticate themselves to the MCP endpoint and execute commands such as ‘wp_update_user’ to escalate their privileges to administrator level.

With administrative access secured, threat actors can upload malicious plugins containing backdoors, modify website content to inject spam, or redirect visitors to harmful sites.

Technical Breakdown of the Exploitation Process

The vulnerability exists within the Meow_MWAI_Labs_MCP class where the plugin registers REST API routes using the rest_api_init() function.

The critical flaw emerges when the No-Auth URL setting is enabled. The code registers special endpoints that include the bearer token directly in the URL path, designed to allow AI agents access without traditional authentication. However, the registration fails to hide these endpoints from the public REST API index.

// No-Auth URL endpoints (with token in path)
$noauth_enabled = $this->core->get_option( 'mcp_noauth_url' );
if ( $noauth_enabled && !empty( $this->bearer_token ) ) {
  register_rest_route( $this->namespace, '/' . $this->bearer_token . '/sse', [
    'methods' => 'GET',
    'callback' => [ $this, 'handle_sse' ],
    'permission_callback' => function ( $request ) {
      return $this->handle_noauth_access( $request );
    },
  ] );
}

An unauthenticated attacker can simply navigate to /wp-json/ on a vulnerable WordPress site to view all registered REST API endpoints.

Sites with No-Auth URL enabled will expose endpoints containing the bearer token in their path structure.

The attacker can then use this token to authenticate requests to the MCP endpoint and execute privileged operations.

Plugin developer Jordy Meow addressed the vulnerability in version 3.1.4 by adding the ‘show_in_index’ => false parameter to prevent the endpoints from appearing in the public index.

However, site administrators who previously had No-Auth URL enabled must rotate their bearer tokens immediately, as the exposed credentials may have already been compromised.

Wordfence deployed firewall rules for Premium, Care, and Response users on October 15, 2025, while free users will receive protection on November 14, 2025.

The firewall detects malicious REST API actions targeting the MCP endpoint and blocks exploitation attempts.

Site owners should update to AI Engine version 3.1.4 immediately and regenerate their bearer tokens through the plugin settings to ensure complete protection against this critical vulnerability.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post AI Engine WordPress Plugin Exposes 100,000 WordPress Sites to Privilege Escalation Attacks appeared first on Cyber Security News.

A sophisticated threat actor known as Curly COMrades has deployed an innovative attack methodology that leverages legitimate Windows virtualization features to establish covert, long-term access to victim networks.

The campaign, which began in early July 2025, represents a significant evolution in adversary tactics as threat actors increasingly seek methods to bypass endpoint detection and response solutions that have become standard defensive tools.

The operation centers on the abuse of Hyper-V virtualization technology on compromised Windows 10 machines.

By enabling the Hyper-V role and deploying a minimalistic Alpine Linux-based virtual machine, the attackers created a hidden operational environment that hosts custom malware while evading traditional host-based security monitoring.

The virtual machine, requiring only 120MB of disk space and 256MB of memory, provides a dedicated platform for running two custom implants: CurlyShell, a persistent reverse shell, and CurlCat, a reverse proxy tool.

Bitdefender researchers identified this advanced campaign through collaboration with the Georgian CERT, which detected a malicious sample communicating with a compromised site under monitoring.

The joint investigation revealed that Curly COMrades, first documented in August 2025 as a threat actor supporting Russian interests in geopolitical hotbeds, has significantly enhanced its toolkit and operational sophistication.

The forensic analysis uncovered that attackers effectively isolated their malware execution environment within a virtual machine, bypassing many traditional security detections by routing malicious traffic through the host’s network stack, making it appear to originate from legitimate IP addresses.

The attack demonstrates meticulous operational planning and technical expertise. Threat actors established persistence through multiple mechanisms, including PowerShell scripts configured via Group Policy for local account creation and Kerberos ticket manipulation for lateral movement.

The deployment of various proxy and tunneling tools such as Resocks, Rsockstun, Ligolo-ng, CCProxy, and Stunnel further illustrates the group’s determination to maintain flexible access channels to compromised environments.

Virtual Machine Deployment and Persistence Mechanism

The deployment sequence begins with enabling the Hyper-V virtualization feature while deliberately disabling its management interface to reduce visibility. The attackers executed the following commands remotely:

dism /online /disable-feature /FeatureName:microsoft-hyper-v-Management-clients /norestart
dism /online /enable-feature /All /LimitAccess /FeatureName:microsoft-hyper-v /norestart

Following a brief interval, the threat actors initiated the payload delivery phase. A RAR archive disguised as a video file was downloaded and extracted to the deceptive directory `c:\programdata\microsoft\AppV\app`, a location designed to blend with legitimate Microsoft application virtualization files. The virtual machine files were then imported using PowerShell:

powershell.exe -c import-vm -path "c:\\programdata\\microsoft\\AppV\\app\\Virtual Machines\\1DBCC80B-5803-4AF1-8772-712C688F408A.vmcx" -Copy -GenerateNewId
powershell.exe -c Start-VM -name WSL

The VM naming convention “WSL” serves as a deception tactic, suggesting the use of Windows Subsystem for Linux, a commonly trusted developer tool that typically receives less security scrutiny. However, this is a fully isolated Hyper-V instance operating outside the standard WSL framework.

Persistence within the virtual machine operates through a root-level crontab entry that executes every four hours at 20 minutes past the hour.

The cron task runs `/bin/alpine_init`, which subsequently launches the CurlyShell implant located at `/bin/init_tools`.

This custom reverse shell maintains HTTPS communication with the command and control infrastructure, while CurlCat manages SSH reverse proxy tunneling on demand.

The VM configuration utilizes Hyper-V’s Default Switch network adaptor with Network Address Translation, ensuring all malicious outbound traffic appears to originate from the compromised host machine’s legitimate IP address, significantly complicating attribution and detection efforts.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Curly COMrades Hacker Group Using New Tools to Create Hidden Remote Access on Compromised Windows 10 appeared first on Cyber Security News.

The notorious FIN7 threat group, also known by the nickname Savage Ladybug, continues to pose a significant risk to enterprise environments through an increasingly refined Windows SSH backdoor campaign.

The group has been actively deploying this sophisticated backdoor mechanism to establish persistent remote access and facilitate data exfiltration operations.

First documented in 2022, the malware has remained largely unchanged in its core functionality, suggesting that FIN7 has found a highly effective attack methodology that continues to evade traditional detection mechanisms.

The attack campaign leverages a combination of batch script execution and legitimate OpenSSH toolsets to create a covert communication channel between compromised systems and attacker-controlled infrastructure.

By exploiting the trust typically placed in SSH protocols, FIN7 operatives can establish reverse SSH and SFTP connections that bypass conventional network monitoring and appear as legitimate administrative traffic.

This technique demonstrates the group’s sophisticated understanding of system administration tools and their ability to weaponize widely-available utilities for malicious purposes.

PRODAFT analysts and researchers identified that the malware employs an install.bat script paired with OpenSSH components to automate the deployment and configuration process.

This approach significantly reduces the operational complexity for threat actors while maintaining a low profile across security logs and event monitoring systems.

Persistence Mechanisms and Evasion Tactics

The persistence strategy employed by FIN7’s SSH backdoor represents a particularly insidious aspect of the threat.

By establishing SSH access points on compromised Windows systems, the attackers ensure continued access even after initial compromise vectors are remediated.

The reverse SSH tunnel configuration allows operators to maintain command and control communication through encrypted channels, making it substantially more difficult for security teams to detect malicious traffic patterns.

The backdoor’s ability to execute both SSH and SFTP operations provides attackers with multiple pathways for data extraction and lateral movement within network environments.

Security researchers have documented that the malware maintains minimal modification signatures, relying instead on legitimate system components to avoid triggering behavioral detection rules.

Organizations must implement robust SSH access controls, monitor for anomalous SSH connection patterns, and maintain comprehensive network segmentation to effectively counter this persistent threat.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post FIN7 Hackers Using Windows SSH Backdoor to Establish Stealthy Remote Access and Persistence appeared first on Cyber Security News.