External risk intelligence

MountDev AI MCP Connector Authorization Bypass Leads to Administrator Token Theft.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-15015

The vulnerability exists in a WordPress plugin that exposes dynamic client registration and OAuth endpoints. These features are commonly exposed on public-facing websites and web applications, making them reachable via the internet by design.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a WordPress plugin, allowing unauthenticated attackers to gain full administrator access by exploiting authorization bypass flaws. This could potentially expose all WordPress content, user data, and settings.

Unauthorized access to WordPress administrator functions.
High impact exposure of all site content and data.
Confirm plugin relevance and exposure to WordPress.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by first registering a self-controlled OAuth client through a publicly accessible endpoint. Then, they can complete the OAuth flow using an unprotected authorization endpoint, bypassing any administrator checks. This grants them an administrator-equivalent token, allowing full control over the WordPress site's content, users, and options via the plugin's tool.

No authentication required.
Unprotected OAuth and client registration endpoints.
Full administrator access to site content and settings.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to gain administrator-level access to the WordPress site by exploiting improperly verified authorization in the MountDev AI MCP Connector plugin. This access would enable them to control all exposed WordPress content, user accounts, and settings through the plugin's tools.

WordPress content and user data.
Unauthenticated access to registration endpoints.
Full administrator control of the site.

Operational Fix

Recommended remediation, mitigation, and detection steps

The MountDev AI MCP Connector for WordPress plugin, due to its authorization bypass vulnerability, makes administrator-equivalent access possible for unauthenticated attackers. This scenario typically involves WordPress site administrators or platform owners who manage plugin deployments. The immediate priority is to discover all instances of this plugin, assess their exposure, identify the accountable owner for each instance, and then determine the appropriate remediation strategy based on the identified risks.

Identify plugin instances and accountable owners.
Verify public accessibility and business criticality.
Plan remediation based on risk and impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MountDev AI MCP Connector for WordPress?

This is a software add-on for WordPress websites designed to bridge the site with AI-driven Model Context Protocol (MCP) tools. It creates a bridge between your WordPress content—including users, settings, and database entries—and external AI systems by providing automated interfaces for these tools to interact with your site's data.

How does CVE-2026-15015 work?

The plugin suffers from a Missing Authorization weakness (CWE-862). It fails to verify that a user has permission to perform sensitive actions. This allows an attacker to interact with the plugin’s registration systems to trick the site into issuing an administrator-level access token, effectively granting them full control without needing a password or existing account.

Do I need to be logged in to trigger this bug?

No. The vulnerability is triggered entirely by unauthenticated users. The plugin provides public-facing endpoints for registering new clients and authorizing access that lack any security gatekeeping. Merely being a visitor to the site is sufficient to reach these endpoints and complete the attack flow; you do not need any prior administrator interaction or specialized user status to initiate the process.

Why does Halo Surface Signal categorize this as an external threat?

Halo Surface Signal flags this as likely reachable because the plugin’s core functionality depends on publicly accessible OAuth and registration endpoints. Because these features are intended to work over the internet to connect with AI tools, the entry point for this vulnerability is exposed by default on any site running the plugin, putting it within reach of remote attackers scanning the public web.

What is the first step if I run this plugin?

Immediately audit your WordPress environment to confirm if the MountDev AI MCP Connector is installed and active. If you find the plugin, identify the team responsible for managing it. Given the risk of total administrative compromise, the most effective practical response is to disable or remove the plugin until you can confirm your installation has been updated to a version that properly enforces authorization.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.