Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.53.3 - Authenticated (MCP Connection Key Holder) Privilege Escalation via MCP Credential Accepted Outside the REST API
- ID
- WPSEC-2026-1559
- Plugin
- Agentimus – AI SEO, llms.txt & MCP for AI Agents (agentimus)
- Affected
- from 1.32.0 before 1.53.4
- Remediation
- Update to 1.53.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- Agentimus – AI SEO, llms.txt & MCP for AI Agents on WPSec AttackSurface
- Fix released
- Published
Description
The Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin for WordPress is vulnerable to Privilege Escalation via the MCP connection token and OAuth access token authentication in versions 1.32.0 up to, and including, 1.53.3. The cause is that the plugin decides whether a request targets the MCP endpoint only from the rest_route parameter or the tail of the URL path, on any entry point. On admin-ajax.php, admin-post.php or wp-login.php no REST dispatch takes place, so the check that limits a credential to the MCP endpoint never runs there. This makes it possible for anyone holding a connection key or an approved assistant's access token, including a read-only one, to act as the credential's owner (typically an administrator) on arbitrary admin-ajax and admin-post handlers. The site must have a connection key or an approved OAuth grant.
References
- https://wpsec.com/vuln/WPSEC-2026-1559/
- https://plugins.svn.wordpress.org/agentimus/tags/1.53.4/
- https://wordpress.org/plugins/agentimus/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS