ByteCoreStack MCP Connector CVE-2026-103068

Requires the ByteCoreStack - MCP Connector for AI Tools plugin (slug bcs-mcp-manager) version ≤ 1.2.2 to be installed and active on a WordPress site, plus an authenticated low-privilege account (subscriber level per the description, consistent with PR:L). No user interaction is needed (UI:N). The key limiting factor is obtaining the subscriber account: trivial on sites with open user registration (default on many membership/community sites), but a real barrier on sites where registration is closed. No other special configuration is indicated.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-exploitable privilege escalation requiring only low-privilege authentication (PR:L) - the description explicitly frames this as 'Subscriber Privilege Escalation,' meaning any registered subscriber-level account can escalate to higher privileges with full confidentiality, integrity, and availability impact on the WordPress site. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no confirmation of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' That said, the pattern (authenticated subscriber-to-admin escalation in a WordPress plugin) is a historically high-value and frequently-weaponized class once details circulate, especially on sites allowing open user registration. The practical risk is gated by two realistic conditions: the plugin must be installed/active, and the attacker needs a subscriber account (trivial where self-registration is enabled, otherwise a meaningful barrier). This is a genuine high-severity issue worth prompt patching on affected sites, but the absence of EPSS/KEV/POC signals means it is not yet evidenced as widespread in-the-wild activity - treat as high-priority patch, not emergency incident, unless open registration is enabled.

An attacker registers (or obtains) a low-privilege subscriber account on a WordPress site running ByteCoreStack - MCP Connector for AI Tools ≤ 1.2.2, then invokes the vulnerable plugin functionality to grant themselves elevated privileges (e.g., administrator), achieving full control over the site. No user interaction or victim action is required, and the attack is performed remotely over the network. No public exploit code is identified at the time of analysis.