CVE-2026-15015: WordPress MountDev AI MCP Auth Bypass

CVE-2026-15015 Overview

CVE-2026-15015 is an authorization bypass vulnerability in the MountDev AI MCP Connector for WordPress plugin affecting all versions up to and including 1.6.1. The plugin fails to properly verify user authorization when handling OAuth flows. Unauthenticated attackers can obtain an administrator-bound OAuth Bearer token by combining the publicly accessible Dynamic Client Registration endpoint with the unprotected authorization endpoint. Successful exploitation grants administrator-equivalent access to the plugin's Model Context Protocol (MCP) tool surface, exposing WordPress content, users, and options. The weakness is classified under [CWE-862] Missing Authorization.

Critical Impact
Unauthenticated remote attackers can obtain administrator-equivalent OAuth Bearer tokens without any user interaction, resulting in full compromise of exposed WordPress content, users, and options.

Affected Products

MountDev AI MCP Connector for WordPress plugin — all versions through 1.6.1
WordPress installations with the MountDev AI MCP Connector plugin enabled
Sites exposing the plugin's Dynamic Client Registration and authorization endpoints

Discovery Timeline

2026-07-23 - CVE-2026-15015 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-15015

Vulnerability Analysis

The MountDev AI MCP Connector for WordPress implements an OAuth 2.0 flow to authorize Model Context Protocol (MCP) clients. The plugin exposes two endpoints that combine to defeat access control. The Dynamic Client Registration endpoint accepts unauthenticated requests and allows callers to register arbitrary OAuth clients with attacker-controlled redirect_uri values. The authorization endpoint does not enforce that an authenticated administrator has approved the client. Together, these flaws let an attacker complete an OAuth authorization code exchange and mint a Bearer token bound to administrator scope without any administrator interaction.

Once issued, the Bearer token authenticates every request against the plugin's MCP tool surface as an administrator. This grants read and write access to posts, users, plugin options, and any other data the MCP tools expose.

Root Cause

The root cause is missing authorization checks on the OAuth endpoints [CWE-862]. Client registration is exposed publicly with no vetting of the requesting party or the supplied redirect URI. The authorization endpoint issues codes without confirming that the resource owner (administrator) has actively consented. The plugin conflates client presence with client trust, treating any self-registered client as legitimate.

Attack Vector

The attack is network-reachable and requires no privileges or user interaction. An attacker sends a Dynamic Client Registration request to the plugin's endpoint, supplying an attacker-controlled redirect_uri. The server returns a client_id and client_secret. The attacker then requests the authorization endpoint using this client, receives an authorization code without any administrator prompt, and exchanges the code for an administrator-bound OAuth Bearer token. The token is then used against MCP tool endpoints to read and modify WordPress data.

See the vulnerable OAuth handling in the plugin source at class-oauth-controller.php L188, L370, L474, and L571.

Detection Methods for CVE-2026-15015

Indicators of Compromise

Unexpected POST requests to the plugin's Dynamic Client Registration endpoint from unknown IP addresses.
OAuth authorization requests with unusual or externally hosted redirect_uri values.
Newly issued Bearer tokens with administrator scope that were not requested by known administrators.
Unattributed changes to WordPress posts, users, or options originating from MCP tool calls.

Detection Strategies

Inspect web server access logs for requests to the plugin's OAuth registration, authorization, and token endpoints preceding any MCP tool invocation.
Correlate client registrations with subsequent authorization code issuance where no logged-in administrator session exists.
Alert on MCP tool endpoint calls that carry Bearer tokens tied to clients registered from external IP addresses.

Monitoring Recommendations

Enable verbose logging on the MountDev AI MCP Connector plugin, capturing client registration events and token issuance.
Forward WordPress and web server logs to a centralized analytics platform for retention and query.
Monitor for privilege changes, new administrator accounts, and plugin or theme modifications following OAuth activity.

How to Mitigate CVE-2026-15015

Immediate Actions Required

Update the MountDev AI MCP Connector for WordPress plugin to a version later than 1.6.1 as soon as a fixed release is available.
If no patched version is available, deactivate and remove the plugin until a fix is published.
Rotate any administrator credentials, application passwords, and API keys that may have been exposed through the MCP tool surface.
Audit WordPress users, posts, options, and installed plugins for unauthorized changes.

Patch Information

Review the plugin repository changeset referenced in the advisory at WordPress Plugin Changeset and the Wordfence Vulnerability Intelligence entry for the current fix status and required upgrade version.

Workarounds

Block external access to the plugin's OAuth endpoints (Dynamic Client Registration, authorization, and token) at the web server or WAF layer until the plugin is patched or removed.
Restrict access to /wp-json/ routes belonging to the plugin using IP allow-listing for known administrator networks.
Revoke any previously issued OAuth clients and Bearer tokens managed by the plugin.

bash

# Example nginx rule to block the vulnerable OAuth endpoints
location ~* /wp-json/mountdev-ai-mcp-connector/ {
    deny all;
    return 403;
}