Description

The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain an administrator-bound OAuth Bearer token via a self-registered client, granting full administrator-equivalent access to the plugin's MCP tool surface and all exposed WordPress content, users, and options. This is exploitable by combining the publicly accessible Dynamic Client Registration endpoint, which allows unauthenticated callers to register arbitrary OAuth clients with an attacker-controlled redirect_uri, with the unprotected authorization endpoint to complete the full OAuth flow without any administrator interaction.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-07-23T10:16:50.047Z",
  "pubdate": "2026-07-23T10:16:50.047Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the MountDev AI MCP Connector for WordPress plugin in all versions up to, and including, 1.6.1. The flaw stems from insufficient authorization checks when performing sensitive actions within the plugin. Unauthenticated attackers can leverage this vulnerability to obtain an administrator-bound OAuth Bearer token by registering a self-registered client. This grants the attacker full administrator-equivalent access to the plugin's Model Context Protocol (MCP) tool surface and exposes all underlying WordPress content, users, and options. The risk implication is severe, as complete administrative compromise of the affected WordPress site can be achieved without requiring any prior authentication, specific privileges, or user interaction. Exploitation relies on abusing publicly accessible endpoints in the OAuth implementation provided by the plugin.",
  "technicalDetails": "The root cause of the vulnerability resides in the MountDev AI MCP Connector for WordPress plugin's OAuth implementation, specifically its failure to properly enforce authorization controls on critical endpoints. The plugin exposes a publicly accessible Dynamic Client Registration endpoint that permits unauthenticated callers to register arbitrary OAuth clients with an attacker-controlled redirect_uri. Furthermore, the authorization endpoint lacks adequate protection, allowing unauthenticated attackers to complete the full OAuth authorization flow without requiring any administrative interaction or session context. The affected components include the Dynamic Client Registration endpoint and the unprotected authorization endpoint within the plugin's OAuth workflow, impacting all versions up to, and including, 1.6.1. Attackers require no authentication, no special privileges, and network exposure is external via HTTP/HTTPS requests to the vulnerable WordPress installation. The step-by-step attack flow proceeds as follows: First, an unauthenticated attacker sends a request to the publicly accessible Dynamic Client Registration endpoint to register an arbitrary OAuth client, specifying an attacker-controlled redirect_uri. Second, the attacker interacts with the unprotected authorization endpoint to initiate and complete the OAuth flow without administrative approval or interaction. Third, the completion of this unauthenticated flow results in the issuance of an administrator-bound OAuth Bearer token. Post-exploitation impact includes full administrator-equivalent access to the plugin's MCP tool surface, granting the attacker the capability to compromise and manipulate all exposed WordPress content, user accounts, and system options."
}