CVE-2026-19807 Overview
The ByteCoreStack MCP Connector for AI Tools plugin for WordPress contains a privilege escalation flaw affecting all versions up to and including 1.2.3. The wp_update_user_meta MCP tool gates writes with current_user_can('edit_user', $uid), which WordPress core's map_meta_cap resolves to the read primitive when the target user ID matches the caller. The plugin's meta key blocklist covers only user_pass, user_activation_key, and session_tokens, leaving wp_capabilities and wp_user_level unprotected. Authenticated attackers with Subscriber-level access can promote themselves to Administrator via the MCP JSON-RPC endpoint.
Critical Impact
Any authenticated user, including Subscribers, can gain full Administrator privileges and take over the WordPress site.
Affected Products
- ByteCoreStack MCP Connector for AI Tools (bcs-mcp-manager) plugin for WordPress
- All versions up to and including 1.2.3
- Fixed in version 1.2.4
Discovery Timeline
- 2026-10-01 - CVE-2026-19807 published to NVD
- 2026-10-03 - Last updated in NVD database
Technical Details for CVE-2026-19807
Vulnerability Analysis
The vulnerability is a privilege escalation flaw [CWE-269] in the plugin's MCP (Model Context Protocol) JSON-RPC endpoint. The execute_tool handler exposes a wp_update_user_meta tool that writes arbitrary user meta values. The authorization check relies on current_user_can('edit_user', $uid), which does not enforce the semantic meaning developers typically expect. When a caller targets their own user ID, WordPress core maps edit_user to the trivial read capability, which every authenticated role possesses.
The plugin attempts to compensate with a meta key blocklist, but this list is incomplete. It blocks only password-adjacent keys and omits the two meta keys that control role assignment: wp_capabilities and wp_user_level. WordPress reads these keys to construct the effective role on each request, so overwriting them produces an immediate Administrator session.
Root Cause
The root cause combines a misunderstood capability check with an allowlist-vs-blocklist anti-pattern. The plugin trusts edit_user to prevent self-modification of privileged attributes. It also enumerates a short list of forbidden meta keys instead of restricting writes to a known-safe set. See the WordPress Plugin Server Code for the vulnerable handler.
Attack Vector
An attacker authenticates to the MCP JSON-RPC endpoint using any Subscriber-or-above account. They then issue a wp_update_user_meta tool call with their own user ID, key=wp_capabilities, and a value such as {'administrator': true}. The plugin passes the authorization check, bypasses the incomplete blocklist, and persists the new role. The next request from that account loads as an Administrator with full site control. The attack requires only network access, low privileges, and no user interaction.
Detection Methods for CVE-2026-19807
Indicators of Compromise
- MCP JSON-RPC requests invoking the wp_update_user_meta tool with key=wp_capabilities or key=wp_user_level.
- Unexpected role changes in the wp_usermeta table where previously low-privilege accounts now hold administrator.
- Access log entries targeting the bcs-mcp-manager plugin's OAuth and MCP endpoints from Subscriber accounts.
- New Administrator users, plugin installs, or theme file edits performed shortly after an MCP tool invocation.
Detection Strategies
- Audit the wp_usermeta table for wp_capabilities values containing administrator on accounts that should not hold that role.
- Correlate WordPress authentication logs with HTTP POSTs to the MCP endpoint to identify privilege changes performed by non-admin users.
- Inspect request bodies for the string wp_capabilities or wp_user_level sent to any bcs-mcp-manager route.
Monitoring Recommendations
- Enable verbose logging on the MCP JSON-RPC endpoint and alert on wp_update_user_meta calls targeting role-related keys.
- Monitor for creation of new Administrator accounts and sudden plugin or theme uploads following MCP activity.
- Watch for OAuth token issuance patterns from the plugin's OAuth server component referenced in the vendor OAuth code.
How to Mitigate CVE-2026-19807
Immediate Actions Required
- Update the ByteCoreStack MCP Connector for AI Tools plugin to version 1.2.4 or later immediately.
- Audit all WordPress user accounts and remove any unauthorized Administrator-level users or capability assignments.
- Rotate credentials, API keys, and OAuth secrets for the affected site, and invalidate existing sessions.
- Review installed plugins, themes, and uploaded files for unauthorized modifications made after the plugin was first installed.
Patch Information
The vendor fixed the issue in version 1.2.4. See WordPress Plugin Changeset 3711908 and WordPress Plugin Changeset 3711909 for the official code changes. Additional analysis is available in the Wordfence Vulnerability Report.
Workarounds
- Deactivate and remove the bcs-mcp-manager plugin until the site can be upgraded to 1.2.4.
- Restrict access to the MCP JSON-RPC endpoint at the web server or WAF layer so that only trusted IP ranges can reach it.
- Enforce least-privilege on WordPress registration, disabling open Subscriber signups where not required.
- Use a WAF rule to block request bodies containing wp_capabilities or wp_user_level sent to plugin endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
