CVE-2026-121576

Summary

The AtlasAiDev MCP Server for WordPress plugin contains an incorrect privilege assignment flaw (CWE-266), allowing authenticated low-privilege users to escalate their privileges to administrative levels. This occurs in versions up to and including 2.0.1, enabling full compromise of confidentiality, integrity, and availability.

Exploitability

Exploitation requires valid low-privilege credentials (PR:L) and no user interaction (UI:N), making it moderately easy for an attacker with a compromised or weakly secured account to escalate privileges.

Blast radius

Successful exploitation grants full administrative control over the WordPress site, enabling data exfiltration, malware deployment, or complete site takeover.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.0.2 or later, as this is the first fixed release addressing the privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.