AtlasMCP: a subscriber could promote themselves to WordPress admin
A low-privilege WordPress account could reach administrator through AtlasMCP's AI tools, fixed in version 2.0.2.
· Patchstack · Research by myhappyhoon
AtlasMCP, a WordPress plugin that lets Claude, ChatGPT and Gemini drive a site over MCP, let a signed-in subscriber change their own role through an AI app in versions up to 2.0.1. Patchstack scores it CVSS 8.8. Fixed in 2.0.2.
01What happened
Patchstack published CVE-2026-121576 on November 7, 2026 against AtlasMCP, a plugin that exposes a WordPress site to Claude, ChatGPT and Gemini over MCP. The researcher myhappyhoon reported it on November 3. Azizul Hasan, the plugin author, shipped 2.0.2 the same day with four security fixes.
02How it works
Incorrect privilege assignment is the root cause, filed as CWE-266. AtlasMCP's own 2.0.2 changelog states that a signed-in low-role user, such as a Subscriber, could change their own role through an AI app, so the MCP tool surface did not re-check what the calling account was allowed to do. Patchstack scores the result CVSS 8.8, with low privileges required and no user interaction.
03Who is affected
Sites running AtlasMCP 2.0.1 or earlier are affected, and the plugin directory reports 300-plus active installations. Any such site that allows self-registration or keeps subscriber accounts is exposed, because an attacker needs only one signed-in low-role account. Version 2.0.2 closed three further issues, listed in the table.
04What to do
Update AtlasMCP to 2.0.2 or later; 2.0.3 is the current release. Then audit the site's user roles for accounts that gained privileges, and revoke MCP tokens created with an application password that has since been deleted.
Sources 3 links, all fetched
- 1patchstack.comPatchstack Advisory
- 2github.comGitHub Advisory
- 3wordpress.orgPlugin Page