CVE-2026-15015

{
  "etk_id": "ETK-2026-1522",
  "cve_id": "CVE-2026-15015",
  "display_id": "CVE-2026-15015",
  "ghsa_id": "GHSA-8g44-6rrm-mf2w",
  "euvd_id": "EUVD-2026-47907",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in MountDev AI MCP Connector for WordPress",
  "summary": "MountDev AI MCP Connector for WordPress through version 1.6.1 does not consistently enforce authorization for its OAuth workflow. An unauthenticated remote attacker may obtain administrator-equivalent access to the plugin's MCP capabilities and exposed WordPress data when its public OAuth registration and authorization endpoints are accessible.",
  "mitigation": "Update MountDev AI MCP Connector for WordPress to version 1.6.4 or later. Until it is updated, disable the plugin or restrict public access to its OAuth registration and authorization endpoints.",
  "vendor": "cascadiawebservices",
  "product": "MountDev AI MCP Connector for WordPress",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.6.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "MountDev AI MCP Connector for WordPress",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "other",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0071,
  "epss_percentile": 0.5278,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 49.238255716666664,
  "t0_at": "2026-07-23T09:33:59.123000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-15T01:50:22.875654+00:00",
      "days": 83.67805269275463,
      "is_lower_bound": false,
      "measured_at": "2026-07-23T09:33:59.123000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-10-13T00:00:00+00:00",
      "days": 82,
      "is_lower_bound": false,
      "measured_at": "2026-07-23T09:33:59.123000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-15015"
    },
    "trigger_signal": {
      "at": "2026-10-13T00:00:00+00:00",
      "days": 81.60139903935185,
      "is_lower_bound": false,
      "measured_at": "2026-07-23T09:33:59.123000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-15015"
    }
  }
}