CVE-2026-19807
Received Received - Intake

Privilege Escalation in ByteCoreStack MCP Connector for WordPress

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Wordfence

Description
The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the `wp_update_user_meta` MCP tool in `execute_tool` gating writes solely with `current_user_can('edit_user', $uid)` — a check that WordPress core's `map_meta_cap` resolves to the `read` primitive when the target user ID matches the caller's own — while enforcing an incomplete meta key blocklist that covers only `user_pass`, `user_activation_key`, and `session_tokens`, leaving the `wp_capabilities` and `wp_user_level` meta keys entirely unprotected. This makes it possible for authenticated attackers with Subscriber-level access and above to elevate their privileges to Administrator by issuing a `wp_update_user_meta` call over the MCP JSON-RPC endpoint with `key=wp_capabilities` and an arbitrary role array such as `{'administrator': true}` targeting their own user ID, causing WordPress to load that account as an Administrator on the next request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-19807
EUVD
EUVD-2026-90548

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bytecore bytecorestack_mcp_connector_for_ai_tools to 1.2.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress has a privilege escalation vulnerability in versions up to 1.2.3. It allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to Administrator by exploiting a weak meta key blocklist in the wp_update_user_meta MCP tool. The tool fails to properly restrict access to critical meta keys like wp_capabilities and wp_user_level, enabling attackers to modify their own user role to administrator.

Detection Guidance

Check WordPress sites for the ByteCoreStack – MCP Connector for AI Tools plugin versions up to 1.2.3. Inspect MCP JSON-RPC logs for wp_update_user_meta calls targeting wp_capabilities or wp_user_level meta keys with unauthorized role changes.

Impact Analysis

If you use the affected plugin, an attacker could gain full administrative control of your WordPress site. This could lead to complete site takeover, installation of malicious code, data theft, or disruption of services. The vulnerability requires only Subscriber-level access, making it accessible to low-privilege users.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by allowing unauthorized users to gain administrative access. This may result in unauthorized data access, modification, or deletion, violating confidentiality and integrity requirements. Organizations could face regulatory fines and reputational damage.

Mitigation Strategies

Update the ByteCoreStack – MCP Connector for AI Tools plugin to the latest version. Disable the plugin if not needed. Review user roles and privileges for suspicious Administrator assignments. Monitor MCP JSON-RPC endpoints for unauthorized wp_update_user_meta calls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19807. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart