ThinkRank AI SEO <= 2.17.1 - Unauthenticated Denial of Service via MCP OAuth Dynamic Client Registration
- ID
- WPSEC-2026-1652
- Plugin
- ThinkRank AI SEO – AI SEO Plugin for WordPress: Schema, XML Sitemaps, Meta Tags, Search Console & Local SEO (thinkrank)
- Affected
- all versions before 2.18.0
- Remediation
- Update to 2.18.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weakness
- CWE-770
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-26
- Attack surface
- ThinkRank AI SEO on WPSec AttackSurface
- Fix released
- Published
Description
The ThinkRank AI SEO plugin for WordPress is vulnerable to resource exhaustion via the MCP OAuth dynamic client registration endpoint in all versions up to, and including, 2.17.1. This is due to missing rate limiting and no limits on the number or length of redirect_uris, or on the length of client_name. This makes it possible for unauthenticated attackers to store oversized client registrations in the OAuth state option, which is read on every MCP bearer-authenticated request, and to push out legitimate pending registrations. This degrades the MCP integration. Exploitation requires the MCP feature to be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1652/
- https://plugins.svn.wordpress.org/thinkrank/tags/2.18.0/
- https://wordpress.org/plugins/thinkrank/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS