# AtlasMCP: a subscriber could promote themselves to WordPress admin

> A low-privilege WordPress account could reach administrator through AtlasMCP's AI tools, fixed in version 2.0.2.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Patchstack
- **Disclosed:** 2026-11-07
- **CVE:** CVE-2026-121576
- **CVSS:** 8.8
- **Affects:** AtlasMCP, WordPress
- **Research by:** myhappyhoon
- **Primary source:** https://patchstack.com/database/wordpress/plugin/ai-workflow-automation-ai-agent-hub/vulnerability/wordpress-mcp-server-for-wordpress-plugin-2-0-1-privilege-escalation-vulnerability
- **Page:** https://theinjection.dev/items/atlasmcp-wordpress-role-escalation/

AtlasMCP, a WordPress plugin that lets Claude, ChatGPT and Gemini drive a site over MCP, let a signed-in subscriber change their own role through an AI app in versions up to 2.0.1. Patchstack scores it CVSS 8.8. Fixed in 2.0.2.

## What happened

Patchstack published CVE-2026-121576 on November 7, 2026 against AtlasMCP, a plugin that exposes a WordPress site to Claude, ChatGPT and Gemini over MCP. The researcher myhappyhoon reported it on November 3. Azizul Hasan, the plugin author, shipped 2.0.2 the same day with four security fixes.

## How it works

Incorrect privilege assignment is the root cause, filed as CWE-266. AtlasMCP's own 2.0.2 changelog states that a signed-in low-role user, such as a Subscriber, could change their own role through an AI app, so the MCP tool surface did not re-check what the calling account was allowed to do. Patchstack scores the result CVSS 8.8, with low privileges required and no user interaction.

## Who is affected

Sites running AtlasMCP 2.0.1 or earlier are affected, and the plugin directory reports 300-plus active installations. Any such site that allows self-registration or keeps subscriber accounts is exposed, because an attacker needs only one signed-in low-role account. Version 2.0.2 closed three further issues, listed in the table.

## What to do

Update AtlasMCP to 2.0.2 or later; 2.0.3 is the current release. Then audit the site's user roles for accounts that gained privileges, and revoke MCP tokens created with an application password that has since been deleted.

## Quick facts

- **CVE:** CVE-2026-121576
- **CVSS:** 8.8, CVSS v3.1, from Patchstack
- **Affected:** AtlasMCP 2.0.1 and earlier
- **Fixed in:** 2.0.2, released 2026-11-03
- **Found by:** myhappyhoon, reported through Patchstack
- **Active installs:** 300-plus, per wordpress.org
- **Also fixed in 2.0.2:** Multisite cross-site database reads, a content search leak, and app-password token revocation

## Sources

1. [Patchstack Advisory](https://patchstack.com/database/wordpress/plugin/ai-workflow-automation-ai-agent-hub/vulnerability/wordpress-mcp-server-for-wordpress-plugin-2-0-1-privilege-escalation-vulnerability)
2. [GitHub Advisory](https://github.com/advisories/GHSA-qfxj-2x5m-gvvg)
3. [Plugin Page](https://wordpress.org/plugins/ai-workflow-automation-ai-agent-hub/)