Critical Privilege Escalation Vulnerability in WordPress Plugin
A high-severity security vulnerability tracked as CVE-2026-121576 has been identified in the MCP Server for WordPress plugin developed by AtlasAiDev. The flaw allows subscriber-level users to escalate their privileges to administrator status, potentially granting full control over affected WordPress installations.
Affected Versions and CVSS Score
The vulnerability affects MCP Server for WordPress plugin versions up to and including 2.0.1. The issue has been assigned a CVSS score of 8.8, classifying it as high severity. According to Patchstack, this vulnerability is highly dangerous and expected to become exploited in mass-exploit campaigns targeting thousands of websites regardless of traffic size or popularity.
Technical Details
The vulnerability stems from an incorrect privilege assignment flaw in the plugin. The security issue allows users with subscriber-level privileges—the lowest permission level in WordPress—to escalate their access to administrator level. This type of vulnerability falls under the OWASP Top 10 category A7: Identification and Authentication Failures.
The vulnerability was reported by security researcher myhappyhoon on November 3, 2026, and was publicly disclosed on November 7, 2026.
Patch and Mitigation
A patched version 2.0.2 has been released to address the vulnerability. Website administrators are strongly advised to update to version 2.0.2 or later immediately.
For organizations unable to update immediately, Patchstack has issued a mitigation rule to block exploitation attempts until the patched version can be deployed. Website owners who cannot perform the update themselves are advised to contact their hosting provider or web developer for assistance.
Risk Assessment
Security experts warn that vulnerabilities of this type are commonly used in mass-exploit campaigns. The ability for low-privilege users to gain administrative access represents a critical security risk, as attackers could leverage compromised subscriber accounts or create new low-privilege accounts to take complete control of vulnerable WordPress sites.
