Skip to content
Threat Feed
Subscribe

Product

MountDev AI MCP Connector for WordPress Plugin <= 1.6.1

1 brief RSS
critical advisory

MountDev AI MCP Connector WordPress Plugin Vulnerability Allows Unauthenticated Admin Access (CVE-2026-15015)

An authorization bypass vulnerability, CVE-2026-15015, in all versions up to 1.6.1 of the MountDev AI MCP Connector for WordPress plugin allows unauthenticated attackers to obtain an administrator-bound OAuth Bearer token by exploiting publicly accessible client registration and an unprotected authorization endpoint, granting full administrator-equivalent access to the plugin's tool surface and WordPress content.

MountDev AI MCP Connector for WordPress plugin <= 1.6.1 +1 wordpress authorization-bypass cve webserver privilege-escalation
1r 2t 1c