High-severity privilege escalation disclosed in MCP Server for WordPress plugin

GitHub published a High severity advisory for AtlasAiDev's MCP Server for WordPress plugin, warning that low privileged attackers can remotely escalate access on sites running it. No patched version is listed yet.

GitHub Security Advisories published a High severity security advisory for AtlasAiDev's MCP Server for WordPress plugin on November 9, 2026, warning that low privileged attackers can remotely escalate their access on affected sites. The disclosure appears in GitHub's advisory for the plugin, which embeds a Model Context Protocol server for AI agent automation directly inside WordPress.

The vulnerability in detail

The flaw is tracked as CVE-2026-121576 and was published November 9, 2026 as GitHub Security Advisory GHSA-qfxj-2x5m-gvvg.
It affects the WordPress plugin ai-workflow-automation-ai-agent-hub, marketed as MCP Server for WordPress and developed by AtlasAiDev, in versions through 2.0.1.
The issue is classified as CWE-266, Incorrect Privilege Assignment, with a CVSS score of 8.8 (High) and vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
The attack can be executed remotely over a network, with low complexity, requiring only low privileges and no user interaction.
Impact is rated High across confidentiality, integrity, and availability.
No patched version is listed in the advisory.

What it means for people who build with AI

Site owners running AI agent automation on WordPress through this plugin are exposed to a remote privilege escalation that could fully compromise the site. The case underscores that third party MCP server implementations, not just the core MCP protocol or its SDKs, are an expanding and under scrutinized attack surface for AI agent tooling.

Availability and next steps

The advisory does not list a patched version of ai-workflow-automation-ai-agent-hub, so sites running the plugin through version 2.0.1 remain exposed until AtlasAiDev releases a fix. Administrators who rely on the plugin for AI agent workflows should review user privilege levels on their sites and watch for unexpected account changes while a patch is pending.

Sources

Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub (GitHub Security Advisories, November 9, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.