Privilege Escalation in AtlasAiDev MCP Server for WordPress
CVE-2026-125771

7.2HIGH

Key Information:

Vendor

WordPress
Status
Mcp Server For WordPress
Vendor
CVE Published:
15 November 2026

What is CVE-2026-125771?

An Incorrect Privilege Assignment vulnerability exists in the AtlasAiDev MCP Server for WordPress, specifically affecting versions from n/a up to 2.0.3. This flaw can allow an attacker to gain elevated privileges, potentially leading to unauthorized access or control over the affected system. Users are strongly advised to evaluate their installations and apply necessary updates to mitigate potential risks.

Affected Version(s)

MCP Server for WordPress 0 <= 2.0.3

References

https://patchstack.com/database/wordpress/plugin/ai-workf...
vdb-entry

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

iml1s | Patchstack Bug Bounty Program
.