{
 "id": "WPSEC-2026-1652",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1652/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1652/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1652/index.md",
 "title": "ThinkRank AI SEO <= 2.17.1 - Unauthenticated Denial of Service via MCP OAuth Dynamic Client Registration",
 "description": "The ThinkRank AI SEO plugin for WordPress is vulnerable to resource exhaustion via the MCP OAuth dynamic client registration endpoint in all versions up to, and including, 2.17.1. This is due to missing rate limiting and no limits on the number or length of redirect_uris, or on the length of client_name. This makes it possible for unauthenticated attackers to store oversized client registrations in the OAuth state option, which is read on every MCP bearer-authenticated request, and to push out legitimate pending registrations. This degrades the MCP integration. Exploitation requires the MCP feature to be enabled.",
 "plugin": {
  "slug": "thinkrank",
  "name": "ThinkRank AI SEO",
  "full_name": "ThinkRank AI SEO – AI SEO Plugin for WordPress: Schema, XML Sitemaps, Meta Tags, Search Console & Local SEO",
  "wordpress_org": "https://wordpress.org/plugins/thinkrank/",
  "advisories_url": "https://wpsec.com/vuln/plugin/thinkrank/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/thinkrank"
 },
 "type": "DOS",
 "cwe": [
  "CWE-770"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.18.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.18.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.18.0",
 "remediation": "Update to 2.18.0 or later.",
 "fix_released": "2026-10-25T06:46:25+00:00",
 "published": "2026-10-26T07:47:27+00:00",
 "updated": "2026-10-25T10:58:06.666520+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1652/",
  "https://plugins.svn.wordpress.org/thinkrank/tags/2.18.0/",
  "https://wordpress.org/plugins/thinkrank/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/thinkrank",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-26"
 }
}