CVE-2026-121576: WordPress MCP Server for WordPress plugin <= 2.0.1 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub allows Privilege Escalation.This issue affects MCP Server for WordPress: from n/a through 2.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hubto a version that resolves this vulnerability.Fixed in 2.0.2
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges (PR:L) and can exploit the issue remotely over the network (AV:N). No user interaction is required (UI:N).
Which plugin versions are affected?
MCP Server for WordPress versions through 2.0.1 are affected. The provided data does not identify a fixed version.
What impact could successful exploitation have?
Successful exploitation can result in privilege escalation. The severity vector rates confidentiality, integrity, and availability impact as high.
Is a default installation known to be affected?
The provided information does not state whether the vulnerable functionality is enabled or reachable in the default configuration.