CVE-2026-103068

Subscriber Privilege Escalation in ByteCoreStack MCP Connector for AI Tools = 1.2.2 versions...

CVE-2026-103068 WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in ByteCoreStack MCP Connector for AI Tools = 1.2.2 versions...

CVE-2026-103068

The WordPress ByteCoreStack – MCP Connector for AI Tools plugin (versions

CVE-2026-103068 WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in ByteCoreStack MCP Connector for AI Tools = 1.2.2 versions...

EUVD-2026-90845

Subscriber Privilege Escalation in ByteCoreStack MCP Connector for AI Tools = 1.2.2 versions...

WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ByteCoreStack MCP Connector for AI Tools versions = 1.2.2...

CVE-2026-19807

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

EUVD-2026-90548

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

CVE-2026-19807 ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

CVE-2026-19807 ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

CVE-2026-19807

The ByteCoreStack – MCP Connector for AI Tools WordPress plugin is vulnerable to Privilege Escalation in all versions up to and including 1.2.3 . The flaw exists in the wp_update_user_meta MCP tool within the execute_tool function, which improperly gates writes using current_user_can('edit_user',...

WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Décio Brandão in WordPress Plugin ByteCoreStack MCP Connector for AI Tools versions = 1.2.3...

PT-2026-103715

Name of the Vulnerable Software and Affected Versions ByteCoreStack – MCP Connector for AI Tools versions prior to 1.2.4 Description Authenticated users with Subscriber-level access or higher can elevate their privileges to Administrator. The issue exists in the execute tool function within the w...

PT-2026-103877

Subscriber Privilege Escalation in ByteCoreStack MCP Connector for AI Tools = 1.2.2 versions...

CVE-2026-19807: Improper Privilege Management

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

CVE-2026-103068: Incorrect Privilege Assignment

Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools = 1.2.2 versions...

CVE-2026-102243

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...

CVE-2026-102243 MODSetter SurfSense MCP Connector Integration test command injection

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...

CVE-2026-102243 MODSetter SurfSense MCP Connector Integration test command injection

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...

EUVD-2026-88609

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...