Mcp
Monthly
Authenticated attackers holding Subscriber-level (or higher) WordPress accounts can escalate themselves to Administrator on any site running the ByteCoreStack - MCP Connector for AI Tools plugin through version 1.2.3, because the plugin's `wp_update_user_meta` MCP tool protects only `user_pass`, `user_activation_key`, and `session_tokens` while leaving `wp_capabilities` and `wp_user_level` writable. A single JSON-RPC call to the plugin's OAuth-gated MCP endpoint, targeting the attacker's own user ID with `key=wp_capabilities` and a role array such as `{"administrator": true}`, changes the account's role on the next request; no user interaction is required and the CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low privilege prerequisite makes this high-priority wherever self-registration is open.
Server-side request forgery in fast-mcp-telegram prior to version 30.1 allows an authenticated MCP client (CVSS PR:L) to make the server fetch arbitrary internal HTTP(S) endpoints and receive the response body back as a Telegram file attachment. The send_message and send_message_to_phone tools accept URL lists that the server downloads via httpx.AsyncClient.get, but the _validate_url_security guard only inspects the literal hostname string and never resolves DNS, so any attacker-controlled domain that resolves to a loopback, private, or link-local address passes validation - even with the secure defaults block_private_ips=True and allow_http_urls=False. Because the fetched content is exfiltrated through the Telegram attachment rather than merely observed, this is a full-read SSRF; exploitation requires an authorized MCP session and a resolving hostname (raw private-IP literals remain blocked), and no public exploit code was identified at time of analysis.
OS command injection in the Git Remove MCP Tool of 0xshariq github-mcp-server (all revisions up to commit 52e764a7d66eac1726fce02ca7bb5a638571801a) lets an attacker who can influence the tool's 'File' argument inject shell metacharacters that are executed by child_process.exec in src/github.ts. Publicly available exploit code exists (reported via a GitHub issue on the project's own repository), but there is no evidence of confirmed active exploitation in CISA KEV, and the vendor has not responded to the report. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates confidentiality, integrity and availability impact as high, although the practical exposure depends heavily on how the MCP server is deployed - a network-accessible MCP transport makes the AV:N path realistic, whereas a local stdio deployment limits reach to whatever can feed input into the connected LLM client.
OS command injection in mbailey VoiceMode through version 8.10.1 lets an authenticated local attacker who can reach the update_config MCP tool or the 'voicemode config set' CLI persist an arbitrary shell payload that executes as the service user on the next Whisper or serve service start (or reboot). The injected value is written verbatim into ~/.voicemode/voicemode.env, which the start scripts load with bash 'source', so constructs such as $(...) or backticks run even inside double quotes because bash performs command substitution there. This is a real but low-urgency issue: the config tools are not part of the default MCP tool set, so the deployment must have explicitly opted into exposing them, the vector is local (AV:L) with low privileges (PR:L), and execution is deferred until a service restart; no public exploit was identified at time of analysis and CISA SSVC records no observed exploitation. Vendor-released patch: v8.10.2.
A directory traversal flaw in mark3labs mcp-filesystem-server v0.11.1 lets a caller write files outside the server's configured allowed directories by routing a write-capable tool through a pre-existing dangling symlink that already sits inside an allowed path. The bug is integrity-only (no read or denial-of-service impact) and requires the broken symlink to exist beforehand, which limits realistic exploitation; the only confirmed affected version from available data is v0.11.1. There is no public exploit identified at time of analysis, SSVC records Exploitation: none, and no vendor-released patch was identified in the supplied data, making this a low-urgency defense-in-depth issue rather than an emergency.
Path traversal in the create_file tool served by the 03-lovepreetSingh MCP application's /api/mcp route lets remote, unauthenticated attackers supply a crafted filePath that escapes the intended base directory and write attacker-controlled content to arbitrary locations on the host filesystem. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:L) reflects a high integrity impact with a limited availability impact, and publicly available exploit code exists via the project's own issue tracker (GitHub issue #3); there is no evidence of confirmed active exploitation (CISA KEV). Because the project is unversioned, the maintainer has not responded to the report, and no fixed release exists, the only realistic limit on real-world risk is deployment scarcity: this is a hobby MCP implementation with negligible confirmed production footprint, though any internet-reachable instance is trivially testable.
Authenticated attackers holding Subscriber-level (or higher) WordPress accounts can escalate themselves to Administrator on any site running the ByteCoreStack - MCP Connector for AI Tools plugin through version 1.2.3, because the plugin's `wp_update_user_meta` MCP tool protects only `user_pass`, `user_activation_key`, and `session_tokens` while leaving `wp_capabilities` and `wp_user_level` writable. A single JSON-RPC call to the plugin's OAuth-gated MCP endpoint, targeting the attacker's own user ID with `key=wp_capabilities` and a role array such as `{"administrator": true}`, changes the account's role on the next request; no user interaction is required and the CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low privilege prerequisite makes this high-priority wherever self-registration is open.
Server-side request forgery in fast-mcp-telegram prior to version 30.1 allows an authenticated MCP client (CVSS PR:L) to make the server fetch arbitrary internal HTTP(S) endpoints and receive the response body back as a Telegram file attachment. The send_message and send_message_to_phone tools accept URL lists that the server downloads via httpx.AsyncClient.get, but the _validate_url_security guard only inspects the literal hostname string and never resolves DNS, so any attacker-controlled domain that resolves to a loopback, private, or link-local address passes validation - even with the secure defaults block_private_ips=True and allow_http_urls=False. Because the fetched content is exfiltrated through the Telegram attachment rather than merely observed, this is a full-read SSRF; exploitation requires an authorized MCP session and a resolving hostname (raw private-IP literals remain blocked), and no public exploit code was identified at time of analysis.
OS command injection in the Git Remove MCP Tool of 0xshariq github-mcp-server (all revisions up to commit 52e764a7d66eac1726fce02ca7bb5a638571801a) lets an attacker who can influence the tool's 'File' argument inject shell metacharacters that are executed by child_process.exec in src/github.ts. Publicly available exploit code exists (reported via a GitHub issue on the project's own repository), but there is no evidence of confirmed active exploitation in CISA KEV, and the vendor has not responded to the report. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates confidentiality, integrity and availability impact as high, although the practical exposure depends heavily on how the MCP server is deployed - a network-accessible MCP transport makes the AV:N path realistic, whereas a local stdio deployment limits reach to whatever can feed input into the connected LLM client.
OS command injection in mbailey VoiceMode through version 8.10.1 lets an authenticated local attacker who can reach the update_config MCP tool or the 'voicemode config set' CLI persist an arbitrary shell payload that executes as the service user on the next Whisper or serve service start (or reboot). The injected value is written verbatim into ~/.voicemode/voicemode.env, which the start scripts load with bash 'source', so constructs such as $(...) or backticks run even inside double quotes because bash performs command substitution there. This is a real but low-urgency issue: the config tools are not part of the default MCP tool set, so the deployment must have explicitly opted into exposing them, the vector is local (AV:L) with low privileges (PR:L), and execution is deferred until a service restart; no public exploit was identified at time of analysis and CISA SSVC records no observed exploitation. Vendor-released patch: v8.10.2.
A directory traversal flaw in mark3labs mcp-filesystem-server v0.11.1 lets a caller write files outside the server's configured allowed directories by routing a write-capable tool through a pre-existing dangling symlink that already sits inside an allowed path. The bug is integrity-only (no read or denial-of-service impact) and requires the broken symlink to exist beforehand, which limits realistic exploitation; the only confirmed affected version from available data is v0.11.1. There is no public exploit identified at time of analysis, SSVC records Exploitation: none, and no vendor-released patch was identified in the supplied data, making this a low-urgency defense-in-depth issue rather than an emergency.
Path traversal in the create_file tool served by the 03-lovepreetSingh MCP application's /api/mcp route lets remote, unauthenticated attackers supply a crafted filePath that escapes the intended base directory and write attacker-controlled content to arbitrary locations on the host filesystem. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:L) reflects a high integrity impact with a limited availability impact, and publicly available exploit code exists via the project's own issue tracker (GitHub issue #3); there is no evidence of confirmed active exploitation (CISA KEV). Because the project is unversioned, the maintainer has not responded to the report, and no fixed release exists, the only realistic limit on real-world risk is deployment scarcity: this is a hobby MCP implementation with negligible confirmed production footprint, though any internet-reachable instance is trivially testable.