CVE-2026-15015

The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain an administrator-bound OAuth Bearer token via a self-registered client, granting full administrator-equivalent access to the plugin's MCP tool surface and all exposed WordPress content, users, and options. This is exploitable by combining the publicly accessible Dynamic Client Registration endpoint, which allows unauthenticated callers to register arbitrary OAuth clients with an attacker-controlled redirect_uri, with the unprotected authorization endpoint to complete the full OAuth flow without any administrator interaction.

• CWE-862

• https://plugins.trac.wordpress.org/browser/mountdev-ai-mcp-connector/tags/1.6.0/includes/class-oauth-controller.php#L188
• https://plugins.trac.wordpress.org/browser/mountdev-ai-mcp-connector/tags/1.6.0/includes/class-oauth-controller.php#L370
• https://plugins.trac.wordpress.org/browser/mountdev-ai-mcp-connector/tags/1.6.0/includes/class-oauth-controller.php#L474
• https://plugins.trac.wordpress.org/browser/mountdev-ai-mcp-connector/tags/1.6.0/includes/class-oauth-controller.php#L571
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3601448%40mountdev-ai-mcp-connector&new=3601448%40mountdev-ai-mcp-connector
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ce8ec66f-5efc-4354-8871-8e35ab4e51fc?source=cve

Published

Jul 23, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15008The Uncanny Automator – Easy Automation, Integration, Webhoo…8.1
• CVE-2026-15010The bbp Style Pack plugin for WordPress is vulnerable to Sto…6.4
• CVE-2026-15011The Customer Support Ticket System & Helpdesk plugin for Wor…9.8
• CVE-2026-15012The Demi – One Click Demo Import, WP Backup & Site Migration…5.3
• CVE-2026-15013The SAML Single Sign On – SSO Login plugin for WordPress is …9.8
• CVE-2026-15014The SMS Alert – SMS & OTP for WooCommerce, Order Notificatio…9.8
• CVE-2026-15016The Paid Memberships Pro – Content Restriction, User Registr…6.4
• CVE-2026-15017The MDJM Event Management plugin for WordPress is vulnerable…8.8
• CVE-2026-15018The Database Collation Fix plugin for WordPress is vulnerabl…5.3
• CVE-2026-1502CR/LF bytes were not rejected by HTTP client proxy tunnel he…5.7
• CVE-2026-15021The wpForo Forum plugin for WordPress is vulnerable to Store…6.4
• CVE-2026-15022The Tutor LMS – eLearning and online course solution plugin …6.5