CVE-2026-19807
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress up to version 1.2.3 is vulnerable to privilege escalation. The vulnerability stems from the `wp_update_user_meta` MCP tool in `execute_tool` gating writes solely with `current_user_can('edit_user', $uid)` – which WordPress core's `map_meta_cap` resolves to the `read` primitive when the target user ID matches the caller's own – while enforcing an incomplete meta key blocklist that covers only `user_pass`, `user_activation_key`, and `session_tokens`, leaving the `wp_capabilities` and `wp_user_level` meta keys entirely unprotected. This allows authenticated attackers with Subscriber-level access and above to elevate their privileges to Administrator by issuing a `wp_update_user_meta` call over the MCP JSON-RPC endpoint with `key=wp_capabilities` and an arbitrary role array such as `{'administrator': true}` targeting their own user ID.
Risk Assessment
An authenticated attacker with low privileges can gain full administrator privileges, potentially leading to complete takeover of the WordPress site.
Recommendation
Immediately update the ByteCoreStack plugin to the latest patched version. Also restrict access to the MCP endpoint and monitor user activity.
Other vulnerabilities in ByteCoreStack – MCP Connector for AI Tools
Original NVD description (English source)
The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the `wp_update_user_meta` MCP tool in `execute_tool` gating writes solely with `current_user_can('edit_user', $uid)` — a check that WordPress core's `map_meta_cap` resolves to the `read` primitive when the target user ID matches the caller's own — while enforcing an incomplete meta key blocklist that covers only `user_pass`, `user_activation_key`, and `session_tokens`, leaving the `wp_capabilities` and `wp_user_level` meta keys entirely unprotected. This makes it possible for authenticated attackers with Subscriber-level access and above to elevate their privileges to Administrator by issuing a `wp_update_user_meta` call over the MCP JSON-RPC endpoint with `key=wp_capabilities` and an arbitrary role array such as `{'administrator': true}` targeting their own user ID, causing WordPress to load that account as an Administrator on the next request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS