[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":67,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":74,"vulnerability-29865":80,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":110},[4,15,24,32,40,47],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":13,"variant":14,"campaign_id":6},"Office Hours #14","office-hours-14","[Live Office Hours, Wed Oct 28] Check, patch, prove: PHP2Shell and other critical CVEs","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_xbwerEx9QFSjfNWIHcjtHw",true,[11,12],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Save your spot","secondary",{"title":16,"slug":17,"text":18,"link":19,"external":9,"targets":20,"cta":22,"variant":14,"campaign_id":23},"PHP2Shell detection - WP Scanner","php2shell-rce-pricing-1","Detect PHP2Shell with the WP Scanner! Available with every paid plan","https:\u002F\u002Fpentest-tools.com\u002Fpricing",[21],"\u002Fcms-vulnerability-scanning\u002Fwordpress-scanner-online-wpscan","See pricing options","php2shell-rce",{"title":25,"slug":26,"text":27,"link":28,"external":29,"targets":30,"cta":28,"variant":14,"campaign_id":23},"PHP2Shell & Node2Shell detection - pricing page","php2shell-rce-pricing","PHP2Shell & Node2Shell detection live in every paid plan (unlimited rescans for patch validation)",null,false,[31],"\u002Fpricing",{"title":33,"slug":34,"text":35,"link":19,"external":9,"targets":36,"cta":22,"variant":14,"campaign_id":34},"Node2Shell detection - Vuln DB homepage, product, CVE page","node2shell","🚨 Detect Node2Shell with any paid plan. Get proof now",[37,38,39],"\u002Fvulnerabilities-exploits","\u002Fproduct","\u002Fvulnerabilities-exploits\u002Fnode2shell-brotli-decoder-remote-code-execution_29896",{"title":41,"slug":42,"text":43,"link":19,"external":9,"targets":44,"cta":46,"variant":14,"campaign_id":23},"PHP2Shell detection - NetScan on the NS page","php2shell-rce-netscan","🚨 Detect Node2Shell + PHP2Shell with NetScan (from $96\u002Fmo for 16 assets)",[45],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick NetScan",{"title":48,"slug":23,"text":49,"link":19,"external":9,"targets":50,"cta":22,"variant":14,"campaign_id":23},"PHP2Shell detection - top pages, pricing CTA","🚨 Detect Node2Shell + PHP2Shell with any paid plan. Get proof",[51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66],"\u002F","\u002Fport-scanner-online-nmap","\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffind-subdomains-of-domain","\u002Fdiscover-hidden-directories-and-files","\u002Fvulnerabilities-exploits\u002Fphp2shell-remote-code-execution-cve-2026-109618-and-cve-2026-109619_29870","\u002Ffor\u002Ffree","\u002Ffeatures\u002Fattack-surface","\u002Ffeatures\u002Fauthenticated-web-app-scanning","\u002Ffeatures\u002Finternal-network-scanning","\u002Ffeatures\u002Fvulnerability-monitoring","\u002Ffeatures\u002Fvulnerability-assessment-reporting","\u002Ffeatures\u002Fpentest-reporting","\u002Fsolutions\u002Ffor-it-teams","\u002Fsolutions\u002Ffor-msps","\u002Fsolutions\u002Ffor-security-teams",["Island",68],{"key":69,"params":70,"result":72},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":71},"{}",{"head":73},{},["Island",75],{"key":76,"params":77,"result":78},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":71},{"head":79},{},{"id":81,"detectable_with":82,"vuln_details":89,"vuln_id":107,"name":108,"published":109,"updated":28},29865,{"tool":83,"engine":86},{"id":84,"name":85},1,"Network Scanner",{"id":87,"name":88},2,"Nuclei",{"id":81,"codename":28,"description":28,"severity":90,"risk_description":91,"public_description":92,"public_recommendation":93,"recommendation":28,"references":94,"cvssv3":99,"epss_score":100,"epss_percentile":101,"cve":102,"in_cisa_catalog":29,"date":104,"software_type":28,"vendor":105,"product":106,"ptt_exploit_capabilities":28},"critical","Unauthenticated remote attackers can obtain Bearer tokens bound to a WordPress administrator account, granting complete administrative control via the MCP interface including read\u002Fwrite access to all posts, pages, users, plugins, themes, site settings, and database options.","MountDev AI MCP Connector for WordPress (mountdev-ai-mcp-connector) \u003C= 1.6.1 is vulnerable to unauthenticated authorization bypass (CWE-862) via its OAuth 2.0 implementation. The plugin exposes a publicly accessible Dynamic Client Registration endpoint (\u002Fmcp-register) at WordPress init-level that allows any unauthenticated caller to register arbitrary OAuth clients. The subsequent authorization endpoint (\u002Fwp-json\u002Fmountdev-ai-mcp-connector\u002Fv1\u002Foauth\u002Fauthorize) then auto-approves the OAuth flow using the first WordPress administrator account found via get_users({role: administrator, number: 1}), issuing an admin-bound authorization code without checking who is making the request. Exchanging this code at \u002Fmcp-token yields a full Bearer token granting administrator-equivalent access to the MCP tool surface and all exposed WordPress content, users, options, and settings.","Update the MountDev AI MCP Connector plugin to version 1.6.2 or later, which adds proper authorization checks to the Dynamic Client Registration and authorization endpoints.",[95,96,97,98],"https:\u002F\u002Fgithub.com\u002Fles-k\u002Fwp-secure-mcp","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmountdev-ai-mcp-connector\u002Ftags\u002F1.6.0\u002Fincludes\u002Fclass-oauth-controller.php#L370","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-15015","https:\u002F\u002Fwww.rapid7.com\u002Fdb\u002Fvulnerabilities\u002Fcve-2026-15015\u002F",9.8,0.02647,0.85503,[103],"CVE-2026-15015","2026-07-23T00:00:00Z","developer-developer-developer","mountdev-ai-mcp-connector","NETSCAN-NUCLEI-CVE-CVE-2026-15015","MountDev AI MCP Connector \u003C= 1.6.1 - Unauthenticated Admin OAuth Token Exposure","2026-10-21T00:00:00Z",["Island",111],{"key":112,"params":113,"result":115},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":114},"{\"text-color\":\"gray\"}",{"head":116},{}]