The vulnerability allows an unauthenticated attacker to gain elevated privileges on a WordPress site that has a SiteSkite MCP AI plugin version 2.1.5 or earlier. The flaw stems from insufficient permission checks, enabling the attacker to exploit the plugin’s functionality without authentication, which can lead to modification of site content, creation of new users, or alteration of site settings, thereby compromising confidentiality, integrity and availability.

All installations of the SiteSkite MCP AI plugin with a version equal to or older than 2.1.5 on WordPress websites are affected. The plugin is distributed through the WordPress plugin repository under the name SiteSkite.

The CVSS score of 8.1 indicates high severity. The EPSS score is not available, so the current exploitation likelihood is uncertain, but the lack of authentication requirement and the wide impact of privilege escalation increase the risk. The vulnerability is not listed in the CISA KEV catalog. Exploitation would involve sending a crafted request to the plugin’s endpoints, bypassing the missing privilege checks; no special credentials or local access are needed, so the attack vector is likely remote via the web interface.