The vulnerability is an incorrect privilege assignment flaw that permits an attacker to elevate privileges within WordPress. By exploiting this weakness, an attacker can gain administrator‑level rights, thereby compromising confidentiality, integrity, and availability of the site. The flaw is categorized under CWE‑266, indicating improper management of privileges.

The affected product is the AtlasAiDev MCP Server for WordPress plugin, named ai‑workflow‑automation‑ai‑agent‑hub. Any installation from the initial release through version 2.0.1 is vulnerable; update to at least 2.0.2 is required to fix the issue.

With a CVSS score of 8.8 the vulnerability is high severity, and the EPSS score is not available, so an exact likelihood cannot be quantified. The plugin operates through the WordPress administrative interface, so the attack vector is likely remote via the web. Because no exploitation evidence is reported, the exact exploitation complexity is unclear, but the high score indicates that an attacker could feasibly obtain elevated privileges if the vulnerability is triggered.