Agentimus WordPress Plugin Broken Access Control (Subscriber Privilege Escalation)
First seen Sep 3, 2026 · Updated Sep 3, 2026 · CVSS 8.1
A WordPress plugin that exposes an MCP interface and llms.txt generation for AI agents contains a broken access control flaw allowing low-privileged Subscriber-level users to perform actions reserved for higher-privilege roles. This could let an attacker with minimal site access escalate privileges or manipulate AI-agent-facing configuration and content. No evidence of active exploitation is provided in the raw data, but the CVSS score indicates meaningful impact if exploited.
Technical Analysis
The vulnerability is a Broken Access Control (BAC) issue in the Agentimus plugin (<=1.51.0), which provides MCP endpoints and llms.txt generation intended to let AI agents interact with WordPress site content and SEO metadata. Improper authorization checks on plugin functionality allow authenticated users with only Subscriber-level privileges to invoke actions or read/write settings that should require Administrator or Editor roles. Because this plugin bridges WordPress with AI agent tooling via MCP, exploitation could let an attacker manipulate the content/instructions surfaced to AI agents (e.g., llms.txt, MCP tool definitions), potentially enabling downstream prompt injection or tool poisoning against any AI agent consuming that plugin's outputs. The entry point is any authenticated low-privilege WordPress account; the impact crosses from the CMS layer into the AI agent tool-consumption layer.
Affected Systems
Agentimus – AI SEO, llms.txt & MCP for AI Agents (WordPress plugin); protocols: MCP
Detection Signatures
- Unexpected Subscriber-role account activity performing admin-level plugin actions
- Unauthorized modifications to llms.txt content or MCP tool/config endpoints
- Anomalous REST/AJAX requests to Agentimus plugin endpoints from low-privilege user sessions
- Audit log entries showing privilege mismatch between WP user role and action performed
Remediation Steps
- 1
Update the plugin
Upgrade Agentimus to a patched version above 1.51.0 as soon as it is released; monitor the plugin changelog/vendor advisory.
- 2
Restrict role capabilities
Audit WordPress user roles and ensure Subscriber accounts have no unnecessary capabilities; apply least privilege via role management plugins if a patch is delayed.
- 3
Monitor MCP/llms.txt outputs
Validate integrity of llms.txt and MCP tool definitions regularly to detect unauthorized tampering that could poison downstream AI agents.
- 4
Limit registration/authentication exposure
Disable open user registration or require admin approval to reduce the pool of accounts that could exploit Subscriber-level access.
- 5
Web Application Firewall rules
Deploy WAF rules to block anomalous requests to known vulnerable plugin endpoints pending patch deployment.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.