8

CVE-2025-6238: meowapps ai_engine Open Redirect

CVSS: 8.0v3.1HighAnalyzed
Published 04-07-2025Last modified 08-07-2025
Open JSON

Vulnerability summary

CVE-2025-6238 is a high (CVSS 8.0) Open Redirect vulnerability in meowapps ai_engine. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29% of scored vulnerabilities.

Overall risk
32/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.0/10
010
High · v3.1 (CVE.org)
EPSS score
0.37%
0%100%
Low · +0.05 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 04-07-2025
    PublishedVulnerability first disclosed.
  2. 08-07-2025
    Last modifiedVulnerability information updated.

Description

The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to intercept the authorization code and obtain an access token by redirecting the user to an attacker-controlled URI. Note: OAuth is disabled, the 'Meow_MWAI_Labs_OAuth' class is not loaded in the plugin in the patched version 2.8.5.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.37%

Chance of exploitation in the next 30 days

Percentile

29%

Versus all other CVEs

30-day change

+0.05 pp

From 0.32% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.37%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Meowapps1 product
Tigroumeow1 product
Wordpress1 product
  • ai-engine2.8.4 (fixed in 2.8.5)

3 vendors · 3 products

References

5 links