ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 - Authenticated (Subscriber+) Privilege Escalation
medium
The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.2. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for authenticated attackers, with subscriber-level access...
- CVSS:
- 6.3
(Wordfence)
- Affected:
- up to 1.2.2
- Fixed in:
- 1.2.4
- Disclosed:
- Oct 1, 2026
CVE-2026-103068 on NVD →
ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool
high
The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the `wp_update_user_meta` MCP tool in `execute_tool` gating writes solely with `current_user_can('edit_user', $uid)` — a check that WordPress core's `map_m...
- CVSS:
- 8.8
(Wordfence)
- Affected:
- up to 1.2.3
- Fixed in:
- 1.2.4
- Disclosed:
- Sep 30, 2026
CVE-2026-19807 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database