CVE-2026-85306: WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.5 - Broken Access Control vulnerability

Q: Who could exploit this issue?

The CVSS vector indicates that exploitation is network-accessible, requires low privileges, and does not require user interaction. An attacker would need an authenticated account with limited privileges.

Q: What is the security impact?

The reported impact is high integrity impact, with no reported confidentiality or availability impact. Successful exploitation could allow unauthorized modification through incorrectly configured access control.

Q: Which versions are affected?

MountDev AI MCP Connector for WordPress versions through 1.6.5 are affected. The provided data does not identify a fixed version.

Published Sep 3, 2026

Updated

Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects MountDev AI MCP Connector for WordPress: from n/a through 1.6.5.

Affected Software

1 affected component

MountDev AI MCP Connector for WordPress<=1.6.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress MountDev AI MCP Connector for WordPress plugin to a version that resolves this vulnerability.
Fixed in 1.6.6

Event History

Sep 3, 2026

CVE Published

via MITRE·04:53 PM

Data Sourced

via MITRE·04:53 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who could exploit this issue?

The CVSS vector indicates that exploitation is network-accessible, requires low privileges, and does not require user interaction. An attacker would need an authenticated account with limited privileges.

What is the security impact?