VulnCheck KEV: CVE-2026-15015

The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

CVE-2026-103068

Subscriber Privilege Escalation in ByteCoreStack MCP Connector for AI Tools = 1.2.2 versions...

CVE-2026-103068

The WordPress ByteCoreStack – MCP Connector for AI Tools plugin (versions

CVE-2026-103068 WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in ByteCoreStack MCP Connector for AI Tools = 1.2.2 versions...

EUVD-2026-90845

Subscriber Privilege Escalation in ByteCoreStack MCP Connector for AI Tools = 1.2.2 versions...

CVE-2026-103068 WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in ByteCoreStack MCP Connector for AI Tools = 1.2.2 versions...

WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ByteCoreStack MCP Connector for AI Tools versions = 1.2.2...

CVE-2026-19807

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

CVE-2026-19807 ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

CVE-2026-19807

The ByteCoreStack – MCP Connector for AI Tools WordPress plugin is vulnerable to Privilege Escalation in all versions up to and including 1.2.3 . The flaw exists in the wp_update_user_meta MCP tool within the execute_tool function, which improperly gates writes using current_user_can('edit_user',...

CVE-2026-19807 ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

EUVD-2026-90548

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Décio Brandão in WordPress Plugin ByteCoreStack MCP Connector for AI Tools versions = 1.2.3...

PT-2026-103715

Name of the Vulnerable Software and Affected Versions ByteCoreStack – MCP Connector for AI Tools versions prior to 1.2.4 Description Authenticated users with Subscriber-level access or higher can elevate their privileges to Administrator. The issue exists in the execute tool function within the w...

CVE-2026-19807: Improper Privilege Management

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

PT-2026-103877

Subscriber Privilege Escalation in ByteCoreStack MCP Connector for AI Tools = 1.2.2 versions...

CVE-2026-103068: Incorrect Privilege Assignment

Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools = 1.2.2 versions...

CVE-2026-102243

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...

CVE-2026-102243

A command injection vulnerability exists in MODSetter SurfSense up to version 2.0.3 . The flaw resides in the MCP Connector Integration component, specifically involving unknown processing of the /api/search-source/connectors/mcp/test file. This vulnerability allows for remote attacks. While the ...

CVE-2026-102243 MODSetter SurfSense MCP Connector Integration test command injection

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...