Your AI Chatbot Can Attack Your WordPress Admin

A visitor types into your chatbot. Later, you open your WordPress dashboard, and that visitor’s text has become code running in your logged-in browser. That’s the uncomfortable idea behind an AI Engine bug disclosed this month. It’s also why AI WordPress security needs more attention than another reminder to update your plugins.

Jotform AI Chatbot has a separate bug, with no official patch yet. If either plugin is on your site, there are a few things to check today.

What happened in AI Engine

AI Engine – The Chatbot, AI Framework & MCP for WordPress, by Jordy Meow, has 90,000+ active installs. Its plugin slug is ai-engine. Wordfence published CVE-2026-96561 on October 1, 2026, rating it 7.2 (high). Versions up to and including 3.8.0 are affected; 3.8.1 fixed it. No login was needed to start the chain.

Here’s how a public chat endpoint led to the admin dashboard:

1. Send a message. Anyone could reach /mwai-ui/v1/chats/submit. The plugin blocked visitors from setting model, but model_ slipped through the filter and was later turned back into model.
2. Put text in the error log. A bad value triggered an error. The plugin wrote raw text to the PHP error log, letting an attacker forge log lines.
3. Let the Advisor read it. AI Engine’s Advisor sends recent PHP errors to an AI model for advice. The forged lines entered its prompt. That’s indirect prompt injection: attacker-controlled text arriving through something the AI was meant to read.
4. Wait for an admin. The AI’s answer was saved and shown in an Advisor dashboard widget without escaping it. Attacker-controlled JavaScript could run when an administrator opened the dashboard, in that administrator’s logged-in session.

That last step is the nasty one. An admin-session script can make changes the admin is allowed to make, including creating accounts or adding a backdoor. This week’s separate Ninja Forms and WPC Product Bundles backdoors article describes a campaign involving a fake plugin and hidden administrators. It is not a report of this AI Engine bug being exploited; there are no public reports of active exploitation.

AI Engine 3.8.4 was released October 8, 2026. Anything from 3.8.1 includes the fix for this chain, but I’d install 3.8.4. Its changelog lists two more security fixes: a chatbot shortcode can change the prompt, model or API key only when its post author can edit others’ posts; the Search settings screen’s search endpoint is limited to administrators.

Jotform AI Chatbot: no patch yet

Jotform – AI Chatbot, slug jotform-ai-chatbot, has 5,000+ active installs. Patchstack published CVE-2026-40803 on October 6, 2026. It’s an unauthenticated cross-site scripting bug rated 7.1, affecting versions up to and including 3.8.2.

The attacker doesn’t need an account, but a logged-in user, such as an admin, must click a crafted link or open a crafted page. As of October 11, 2026, Patchstack lists no official patch. Version 3.8.2, released September 24, 2026, is the newest. Updating to it won’t fix this.

I’d deactivate and remove the plugin until a patched version appears. Don’t click odd links to your own site while you’re logged in as admin, either. Your domain in a link isn’t a safety guarantee.

---

Why AI WordPress security is a different job

AI plugins can read chats, error logs, product reviews, form entries or scraped pages, send that material to a model, then display the answer in a dashboard widget or post. That creates a path from visitor-supplied text to somewhere you trust. The model doesn’t make the text safe just becuase it rewrote it. Treat its output as untrusted input too.

These plugins may also hold API keys or expose REST endpoints and MCP tools, which let an AI assistant act on your site. AI Engine’s 3.8.4 changelog says its MCP Plugins and Themes options “can read and edit files.” If you enable that access, treat the connection like another admin account. Who can use it? What can it change? For most small shops, AI file editing is more power than they need.

Prompt injection won’t be solved by asking the AI to behave better. The plugin has to limit what gets read, control who can request actions and safely handle model output. If those boundaries aren’t clear, an AI security analysis can help you work out what your chatbot can actually reach.

A checklist for any AI plugin on your site

Open your plugin list and pick each AI feature in turn, including old experiments. You can start without reading code:

• What does it read? Check its settings for access to chats, logs, orders, posts, reviews and form entries. Which of those contain visitor text?
• Where does it write? Is output shown in the dashboard or published in posts? Who reviews it first?
• Does it expose MCP tools or REST endpoints? Find out who can use them and what they can do. Switch off unused tools.
• Who controls the API keys? Check where they’re stored, who can change them and whether your API provider allows spending limits.
• Is it updated fast? AI Engine gets frequent security fixes. Check your installed version and plan how you’ll apply fixes. If that task keeps slipping, WordPress maintenance may be worth handing off.
• Do you use it? If a chatbot trial ended, remove the plugin. Don’t leave an unused feature connected to your site.

---

What to do today

Check whether ai-engine or jotform-ai-chatbot is installed, even if inactive. Update AI Engine to 3.8.4; deactivate and remove Jotform AI Chatbot until there’s a patched release. If a warning leaves you unsure which version is installed, use this guide to checking whether a plugin CVE affects your site.

Then open WordPress Users and review the administrator accounts. Don’t recognize a name or email address? Investigate it before deleting anything, and check what that account may have changed. After that, look at your enabled AI features. You might find a chatbot you meant to switch off months ago.