CVE-2026-85306: CWE-862 Missing Authorization in Cascadia Web Services MountDev AI MCP Connector for WordPress

This vulnerability (CWE-862) in the MountDev AI MCP Connector for WordPress arises from missing authorization checks, which means that the plugin does not properly enforce access control on certain functions or resources. This can allow an attacker with some level of privileges (low privileges required) to perform unauthorized actions that impact the integrity of the system. The vulnerability affects versions up to and including 1.6.5. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker with low privileges can exploit the missing authorization to perform unauthorized actions that compromise the integrity of the affected WordPress site. There is no impact on confidentiality or availability. This could lead to unauthorized modifications or manipulations within the application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No temporary or official fixes are currently documented.