CVE-2026-19807 is a privilege escalation vulnerability in the ByteCoreStack – MCP Connector for AI Tools WordPress plugin affecting all versions up to and including 1.2.3. The vulnerability stems from the `wp_update_user_meta` MCP tool in the `execute_tool` function, which gates write operations with `current_user_can('edit_user', $uid)`. WordPress core resolves this capability check to the `read` primitive when the target user ID matches the caller's own, effectively allowing users to update their own metadata with minimal restrictions. The plugin enforces a meta key blocklist that excludes `wp_capabilities` and `wp_user_level`, leaving these keys unprotected. An authenticated attacker can exploit this by sending a `wp_update_user_meta` call via the MCP JSON-RPC endpoint with `key=wp_capabilities` and an arbitrary role array such as `{'administrator': true}`, resulting in the attacker gaining Administrator privileges on their account.

An authenticated user with Subscriber-level access or higher can escalate their privileges to Administrator by exploiting this vulnerability. This allows full administrative control over the WordPress site, including the ability to modify site settings, install plugins, and manage other users. The CVSS v3.1 score is 8.8 (High), reflecting the network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

No patch or official fix is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the MCP JSON-RPC endpoint to trusted users only, or disable the ByteCoreStack – MCP Connector for AI Tools plugin if possible to prevent exploitation.