Authorization Bypass in MountDev AI MCP Connector Plugin for WordPress

CVE-2026-15015

What is CVE-2026-15015?

The MountDev AI MCP Connector for WordPress allows unauthorized users to exploit a vulnerability that bypasses the necessary authorization checks. Attackers can register arbitrary OAuth clients via a public registration endpoint and gain access to secure functionalities of the plugin. This includes obtaining an OAuth Bearer token tied to administrator privileges, which can lead to unauthorized control over WordPress content and user options. This vulnerability affects all versions up to and including 1.6.1, highlighting the importance of secure token management and proper authorization mechanisms in plugin development.

References