Authorization Bypass in MountDev AI MCP Connector Plugin for WordPress
CVE-2026-15015

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Mountdev Ai Mcp Connector For WordPress
Vendor
CVE Published:
23 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-15015?

The MountDev AI MCP Connector for WordPress allows unauthorized users to exploit a vulnerability that bypasses the necessary authorization checks. Attackers can register arbitrary OAuth clients via a public registration endpoint and gain access to secure functionalities of the plugin. This includes obtaining an OAuth Bearer token tied to administrator privileges, which can lead to unauthorized control over WordPress content and user options. This vulnerability affects all versions up to and including 1.6.1, highlighting the importance of secure token management and proper authorization mechanisms in plugin development.

Affected Version(s)

MountDev AI MCP Connector for WordPress 0 <= 1.6.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

wp-secure-mcp
Created by les-k

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/mountdev-ai-mc...
https://plugins.trac.wordpress.org/browser/mountdev-ai-mc...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

AeonRisk
.