IT SBIT Services
Schneeberger
DEEN
CVE tracker

ByteCoreStack MCP Connector: Privilege escalation via wp_update_user_meta tool

CVE-2026-19807High 8.8

← All vulnerabilities

Summary

The WordPress plugin ByteCoreStack – MCP Connector for AI Tools (up to and including version 1.2.3) lets authenticated users change their own WordPress capabilities through the MCP tool wp_update_user_meta. The tool only checks edit_user on the caller's own account and does not block the meta keys wp_capabilities and wp_user_level. An attacker with a Subscriber account or higher can therefore make their account an Administrator, which gives full control over the WordPress site.

Affected

  • ByteCoreStack – MCP Connector for AI Tools (slug bcs-mcp-manager) versions 1.2.3 and earlier
  • Default configuration: unaffected
  • Vulnerable when the MCP server feature is enabled

Fixed in

  • Likely 1.2.4 (based on the referenced changeset; not yet verified against the vendor advisory or the Wordfence page)

Workaround

  • No vendor-published workaround found.
  • Disable the plugin or its MCP server feature until a fixed version is installed.

Exploitation

  • CISA SSVC: exploitation none, automatable no.
  • Not listed in CISA KEV.
  • No public proof of concept or exploitation reports found as of the research date.

Our recommendation

  • Check whether the plugin is installed and whether the MCP server feature is enabled.
  • Update to the current release from wordpress.org (verify that it is 1.2.4 or later) or disable the plugin until the update is applied.
  • Review administrator and other privileged accounts for unexpected additions and check the roles of low-privilege accounts.
  • Restrict or disable open user registration if it is not needed.
  • Monitor for unexpected role changes in the WordPress user table and audit logs.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:01.

Original description (NVD)

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the `wp_update_user_meta` MCP tool in `execute_tool` gating writes solely with `current_user_can('edit_user', $uid)` — a check that WordPress core's `map_meta_cap` resolves to the `read` primitive when the target user ID matches the caller's own — while enforcing an incomplete meta key blocklist that covers only `user_pass`, `user_activation_key`, and `session_tokens`, leaving the `wp_capabilities` and `wp_user_level` meta keys entirely unprotected. This makes it possible for authenticated attackers with Subscriber-level access and above to elevate their privileges to Administrator by issuing a `wp_update_user_meta` call over the MCP JSON-RPC endpoint with `key=wp_capabilities` and an arbitrary role array such as `{'administrator': true}` targeting their own user ID, causing WordPress to load that account as an Administrator on the next request.

NVD references (13)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed