An authorization bypass vulnerability in the MountDev AI MCP Connector plugin permits unauthenticated attackers to gain administrative privileges by manipulating the OAuth flow.

This vulnerability stems from a failure to verify user authorization during the OAuth process. Unauthenticated attackers can exploit the dynamic client registration endpoint to register malicious clients and subsequently obtain administrator-bound tokens.

This vulnerability grants an attacker full administrative-equivalent access to the WordPress site, including control over user accounts, site configuration, and sensitive content. Given the CVSS score of 9.8, the business impact is extreme, as it effectively nullifies existing authentication controls and allows for total site takeover and data breach.

Immediate Action: Update the MountDev AI MCP Connector plugin to version 1.6.2 or later immediately.

Proactive Monitoring: Audit administrative user accounts for suspicious activity or unauthorized account creation that may have occurred during the period the plugin was vulnerable.

Compensating Controls: Ensure that sensitive administrative endpoints are restricted by IP address or secondary authentication mechanisms if they are accessible via the plugin's tool surface.

Public Exploit Available: Unknown

The risk of unauthorized administrative access is critical. Organizations using the MountDev AI MCP Connector must apply the security update immediately. If patching is delayed, it is highly recommended to disable the plugin to prevent potential exploitation of the vulnerable OAuth endpoints.