Bytecorestack Mcp Connector For Ai Tools
Monthly
Authenticated attackers holding Subscriber-level (or higher) WordPress accounts can escalate themselves to Administrator on any site running the ByteCoreStack - MCP Connector for AI Tools plugin through version 1.2.3, because the plugin's `wp_update_user_meta` MCP tool protects only `user_pass`, `user_activation_key`, and `session_tokens` while leaving `wp_capabilities` and `wp_user_level` writable. A single JSON-RPC call to the plugin's OAuth-gated MCP endpoint, targeting the attacker's own user ID with `key=wp_capabilities` and a role array such as `{"administrator": true}`, changes the account's role on the next request; no user interaction is required and the CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low privilege prerequisite makes this high-priority wherever self-registration is open.
Authenticated attackers holding Subscriber-level (or higher) WordPress accounts can escalate themselves to Administrator on any site running the ByteCoreStack - MCP Connector for AI Tools plugin through version 1.2.3, because the plugin's `wp_update_user_meta` MCP tool protects only `user_pass`, `user_activation_key`, and `session_tokens` while leaving `wp_capabilities` and `wp_user_level` writable. A single JSON-RPC call to the plugin's OAuth-gated MCP endpoint, targeting the attacker's own user ID with `key=wp_capabilities` and a role array such as `{"administrator": true}`, changes the account's role on the next request; no user interaction is required and the CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low privilege prerequisite makes this high-priority wherever self-registration is open.