al-ice.ai

Low Privilege In, Full Control Out: CVE-2026-121576 Privilege Escalation in AtlasAiDev’s MCP Server for WordPress

AI Vulnerabilities & CVEs by al-ice.ai Editorial

A new CVE entry published in NVD on 9 November 2026 puts another AI-connector plugin on the board: CVE-2026-121576, an incorrect-privilege-assignment vulnerability (CWE-266) in AtlasAiDev’s MCP Server for WordPress (ai-workflow-automation-ai-agent-hub), rated CVSS 8.8 HIGH. Every version through 2.0.1 is affected; the issue is fixed in 2.0.2. Patchstack, which catalogued the flaw, states the impact plainly: a low-privilege user can become an admin and gain full control. For a plugin whose entire purpose is to expose WordPress to AI agents, an authorization boundary that collapses upward is the worst kind of bug in the worst kind of place.

What the record says

The NVD record is spare but unambiguous: incorrect privilege assignment allowing privilege escalation, affecting MCP Server for WordPress from n/a through 2.0.1, with Patchstack’s database entry as the reference. Patchstack’s entry fills in the disclosure history: reported 3 November 2026 by researcher myhappyhoon, published 7 November 2026, developer AtlasAiDev, patched in 2.0.2, Patchstack priority High. Patchstack flags this class of flaw as one attackers fold into mass-exploit campaigns against thousands of sites at a time — and an MCP bridge plugin is an attractive target precisely because it sits at the junction of two privilege domains: whatever the site can do, and whatever the connected agent is allowed to ask for.

Why an MCP plugin’s auth bug is worse than an ordinary plugin’s auth bug

A garden-variety WordPress privilege escalation hands the attacker the admin panel. The same bug in a Model Context Protocol server hands them the admin panel through the agent interface — the channel organizations are currently racing to wire into content, commerce and support workflows with the least scrutiny. The blast radius is not just posts and settings; it is every tool the MCP server exposes to connected agents, now operable at administrator privilege, and every downstream system those tools can reach. This is a pattern, not an outlier: September brought three auth failures in another WordPress MCP plugin, including one-click admin creation, and the NetLicensing MCP traversal with its WordPress draft-disclosure twin showed the same junction failing the other way. The AWS serverless MCP deployment-status traversal and the seven-CVE batch across MCP’s own reference servers and Desktop Commander complete the picture: the connector layer keeps shipping with the authorization rigor of a demo.

What to actually do

  1. Update MCP Server for WordPress to 2.0.2 or later immediately, and treat any forked or vendored copy as affected until its code is diffed against the patch.
  2. Audit user registrations and role changes on sites running ≤ 2.0.1 during the exposure window — privilege-escalation flaws leave their evidence in the users table.
  3. Inventory which agent-facing tools the plugin exposes and what privilege they execute at; an MCP server running with more authority than its least-privileged caller is the precondition this CVE class exploits.
  4. If you run Patchstack or equivalent virtual patching, confirm the mitigation rule for this entry is active on any site that cannot update today.

Our verification was read-only. We read the NVD JSON record for CVE-2026-121576 first-hand (published 9 November 2026, CVSS 8.8 HIGH, CWE-266, affected range through 2.0.1, Patchstack reference) and the full Patchstack database entry first-hand (MCP Server for WordPress, developer AtlasAiDev, vulnerable ≤ 2.0.1, patched 2.0.2, credited to myhappyhoon, reported 3 November 2026, published 7 November 2026, High priority). The mass-exploitation framing is Patchstack’s general guidance for this severity class, stated as such. We installed nothing, tested no exploit, scanned no site, and contacted no vendor. Brave Search was used for discovery only.

Sources: