ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-19807 · Microsoft / collected KEV context

cve-program · CVE-2026-19807

• https://www.wordfence.com/threat-intel/vulnerabilities/id/ac09bf3e-49cf-4f11-92ba-d1fbf6f587d7?source=cve
• https://plugins.trac.wordpress.org/browser/bcs-mcp-manager/tags/1.2.0/includes/MCP/Server.php#L2046
• https://plugins.trac.wordpress.org/browser/bcs-mcp-manager/tags/1.2.0/includes/MCP/Server.php#L2042
• https://plugins.trac.wordpress.org/browser/bcs-mcp-manager/tags/1.2.0/includes/MCP/Server.php#L2044
• https://plugins.trac.wordpress.org/browser/bcs-mcp-manager/tags/1.2.0/includes/MCP/Server.php#L332
• https://plugins.trac.wordpress.org/browser/bcs-mcp-manager/tags/1.2.0/includes/OAuth/Server.php#L122
• https://plugins.trac.wordpress.org/browser/bcs-mcp-manager/tags/1.1.0/includes/MCP/Server.php#L2046
• https://plugins.trac.wordpress.org/browser/bcs-mcp-manager/tags/1.1.0/includes/MCP/Server.php#L2042
• https://plugins.trac.wordpress.org/browser/bcs-mcp-manager/tags/1.1.0/includes/MCP/Server.php#L2044
• https://plugins.trac.wordpress.org/browser/bcs-mcp-manager/tags/1.1.0/includes/MCP/Server.php#L332
• https://plugins.trac.wordpress.org/browser/bcs-mcp-manager/tags/1.1.0/includes/OAuth/Server.php#L122
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3711909%40bcs-mcp-manager%2Ftags%2F1.2.4&old=3711721%40bcs-mcp-manager%2Ftags%2F1.2.3
• https://plugins.trac.wordpress.org/changeset/3711908/bcs-mcp-manager/trunk/includes/MCP/Server.php

No related operational record is retained in the current change model.