Description

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents <= 1.51.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-03T17:17:28.880Z",
  "pubdate": "2026-09-03T17:17:28.880Z",
  "executiveSummary": "The Agentimus plugin for WordPress, specifically versions 1.51.0 and below, contains a critical broken access control vulnerability. This vulnerability allows authenticated users with the 'Subscriber' role to perform unauthorized actions restricted to administrative users. By exploiting insufficient capability checks, attackers can manipulate plugin settings or execute sensitive functions typically reserved for elevated accounts. The issue stems from a failure to validate user permissions within the plugin's internal request handlers. Successfully exploiting this flaw can lead to unauthorized configuration changes, potential data exposure, or the manipulation of AI agent settings, compromising the integrity of the SEO and LLM-related functionalities. Given the nature of the plugin's integration with AI and LLM services, unauthorized access could lead to further downstream risks if external service configurations are altered or exposed. This vulnerability requires a valid Subscriber-level account on the target WordPress instance, posing a significant risk in multi-user environments where user registration is enabled.",
  "technicalDetails": "The vulnerability is identified as a broken access control flaw within the Agentimus plugin, version 1.51.0 and prior. The root cause lies in the inadequate implementation of WordPress capability checks (current_user_can()) within the plugin’s AJAX or REST API endpoints. Instead of verifying that the requesting user possesses 'manage_options' or other administrative capabilities, the plugin code fails to restrict access to these sensitive functions, effectively allowing any authenticated user to trigger them.\nThe attack flow begins with the attacker establishing a valid session as a Subscriber. The attacker identifies the specific AJAX action or API endpoint responsible for managing the plugin's core configuration—such as settings related to AI agent behavior, SEO parameters, or llms.txt generation. Because the plugin does not enforce proper authorization checks during the request handling process, the server executes the requested action upon receiving the payload from the Subscriber.\nSpecifically, when the plugin registers its administrative controllers, it fails to define the required capability argument in the hook registration. Consequently, the application logic assumes that any user session, regardless of their role, is authorized to invoke the associated callbacks. An attacker can craft a HTTP request to the vulnerable endpoint with the appropriate action parameter. The server-side code processes this request, allowing the attacker to bypass the expected permission gate.\nThe post-exploitation impact is significant. An attacker can modify critical settings, such as altering the configuration of LLM integration parameters, injecting malicious prompts into the SEO workflow, or retrieving internal configuration data that may expose sensitive integration keys. By manipulating these settings, an attacker may influence the SEO outcomes, perform data scraping through the LLM interface, or potentially pivot to more severe attacks if the plugin configuration affects server-side resource allocation. This vulnerability is particularly dangerous because it bypasses the security principle of least privilege, allowing low-privileged users to perform unauthorized administrative modifications to the site's environment."
}