What happened
A batch of low-blast-radius AI-adjacent plugin/framework CVEs published 2026-09-23/24: AI Engine <=3.7.8 unauthenticated IDOR (CVE-2026-93623, CVSS 5.3); WSP MCP - AI Agents Connector <=2.7.0 contributor broken access control (CVE-2026-93529, CVSS 6.5); TREK travel planner MCP get_trip_summary tool fired for scoped OAuth tokens lacking trips:read (CVE-2026-77321) and attacker-controlled llm_base_url used in AI-assisted import (CVE-2026-77294, CVSS 8.1); Directorist AI-Powered Business Directory plugin before 8.9.5 SSRF via user-supplied URL (CVE-2026-84046, CVSS 5.0) plus follower IDOR/authz issues (CVE-2026-84206 family); YunaiV ruoyi-vue-pro AiKnowledgeDocumentServiceImpl SSRF (CVE-2026-97320, CVSS 6.3).
Why it matters
These are precise but narrow AI-ecosystem vulnerabilities - MCP tool-scope far actions, agent llm_base_url poisoning (SSRF to attacker LLM endpoint), and SSRF/IDOR in GenAI plugins - that extend the untrusted-model-configuration and agent-scope-bypass patterns into small but real customer bases.
Attack vector
Unauthenticated/authenticated requests to plugin REST endpoints (IDOR), contributor-level actions on MCP connector settings, attacker-set llm_base_url/SSRF URL steering agent or server outbound requests.
Affected systems
AI Engine WP <=3.7.8; WSP MCP AI Agents Connector <=2.7.0; TREK <3.3.0; Directorist <8.9.5; ruoyi-vue-pro <= 2026.08 (AI Knowledge module)
Mitigation
Update plugins/frameworks to patched versions (AI Engine >3.7.8, WSP MCP >2.7.0, TREK 3.3.0+, Directorist 8.9.5+); for ruoyi-vue-pro apply vendor patch per VulDB.