CVE-2026-15015
Received Received - Intake

Authorization Bypass in MountDev AI MCP Connector for WordPress

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: Wordfence

Description
The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain an administrator-bound OAuth Bearer token via a self-registered client, granting full administrator-equivalent access to the plugin's MCP tool surface and all exposed WordPress content, users, and options. This is exploitable by combining the publicly accessible Dynamic Client Registration endpoint, which allows unauthenticated callers to register arbitrary OAuth clients with an attacker-controlled redirect_uri, with the unprotected authorization endpoint to complete the full OAuth flow without any administrator interaction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-15015
EUVD
EUVD-2026-47907

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mountdev mcp_connector to 1.6.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The MountDev AI MCP Connector for WordPress plugin has an authorization bypass flaw in versions up to 1.6.1. It fails to verify user permissions for actions, allowing unauthenticated attackers to obtain an admin OAuth token via a self-registered client. This grants full admin access to the plugin's tools and WordPress content.

Detection Guidance

To detect this vulnerability, check if the MountDev AI MCP Connector plugin is installed and verify its version. If it is version 1.6.1 or lower, it is vulnerable. Inspect network traffic for unauthorized OAuth client registrations or authorization requests to the Dynamic Client Registration endpoint.

Impact Analysis

Attackers can gain full control over your WordPress site, including access to all content, user data, and settings. They can modify or delete data, install malicious plugins, or take over your site entirely without needing credentials.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately update the MountDev AI MCP Connector plugin to the latest version if an update is available. If no update is available, consider disabling or removing the plugin until a patch is released. Review OAuth client registrations for unauthorized entries and revoke any suspicious tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15015. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart