WordPress MCP Connector Privilege Escalation via Meta Key Bypass

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the `wp_update_user_meta` MCP tool in `execute_tool` gating writes solely with `current_user_can('edit_user', $uid)` — a check that WordPress core's `map_meta_cap` resolves to the `read` primitive when the target user ID matches the caller's own — while enforcing an incomplete meta key blocklist that covers only `user_pass`, `user_activation_key`, and `session_tokens`, leaving the `wp_capabilities` and `wp_user_level` meta keys entirely unprotected. This makes it possible for authenticated attackers with Subscriber-level access and above to elevate their privileges to Administrator by issuing a `wp_update_user_meta` call over the MCP JSON-RPC endpoint with `key=wp_capabilities` and an arbitrary role array such as `{'administrator': true}` targeting their own user ID, causing WordPress to load that account as an Administrato

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The ByteCoreStack MCP Connector for AI Tools WordPress plugin (versions ≤1.2.3) contains a critical privilege escalation vulnerability in its `wp_update_user_meta` MCP tool. The vulnerability stems from insufficient access controls and an incomplete meta key blocklist that fails to prevent unauthorized modification of sensitive user metadata. While the plugin checks `current_user_can('edit_user', $uid)`, WordPress's capability mapping resolves this to read-level permissions when users modify their own accounts, allowing authenticated attackers to escalate privileges by writing to unblocked meta keys. This affects all WordPress installations running the vulnerable plugin versions, particularly those with multiple user roles where privilege separation is critical for security posture.

Casky's 224 mapped skills against MITRE ATT&CK technique TA0004 (Privilege Escalation) enable detection of this attack pattern through Claude's extended reasoning capabilities. Practitioners using Casky would identify suspicious indicators including: unauthorized modifications to user metadata fields outside the incomplete blocklist, capability check bypass attempts targeting `wp_update_user_meta`, and role/capability elevation tied to MCP tool invocations. The platform's security skill mapping would flag attempts to manipulate user meta keys associated with capabilities, roles, or administrator settings—revealing the gap between intended access controls and actual enforcement. Security teams would see findings highlighting the discrepancy between capability checks and WordPress's internal capability resolution, combined with meta key write patterns that bypass the insufficient security allowlist, enabling rapid identification and containment of exploitation attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-19807.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-19807

Casky has 224 skills that investigate the attack patterns behind CVE-2026-19807. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn