Broken access control in WSP MCP plugin exposes unpublished posts
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
The bilalnaseer WSP MCP plugin for WordPress is affected in versions from 0 through 2.9.5. The wsp_get_posts MCP tool is registered without a capability requirement, so the endpoint accepts any logged-in user, which is an instance of CWE-863 Incorrect Authorization. An authenticated attacker with Subscriber-level access or higher can read titles, URLs, authors, categories, tags and excerpts of draft, pending and scheduled posts on the site.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any logged-in user, and the wsp_execute_get_posts() callback honouring a caller-supplied status=all argument that expands into a WP_Query over 'publish', 'draft', 'pending' and 'future' posts with no author or ownership filter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the titles, URLs, authors, categories, tags and 40-word excerpts of every unpublished (draft/pending/scheduled) post on the site.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Bilal Naseer | WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents | up to 2.9.5 | — | No fix listed | CNA |
- WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents VendorBilal Naseer Affected up to 2.9.5 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for WSP MCP (Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents).
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-109382
- 2026-10-16 Alias added: GHSA-829v-95xx-xwjh
References
Other 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/809eb78f-fd8e-4434-a36b-bb8e313cf264?source=cve
- https://plugins.trac.wordpress.org/browser/wsp-mcp-ai-agents-connector/tags/2.9.5/includes/abilities/posts.php#L7
- https://plugins.trac.wordpress.org/browser/wsp-mcp-ai-agents-connector/tags/2.9.5/includes/tools/native-tools.php#L42
- https://plugins.trac.wordpress.org/browser/wsp-mcp-ai-agents-connector/tags/2.9.5/includes/server/class-auth.php#L59
- https://plugins.trac.wordpress.org/browser/wsp-mcp-ai-agents-connector/tags/2.9.5/includes/server/class-auth.php#L123
- https://plugins.trac.wordpress.org/browser/wsp-mcp-ai-agents-connector/tags/2.9.5/includes/server/class-mcp-server.php#L78
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3743711%40wsp-mcp-ai-agents-connector&new=3743711%40wsp-mcp-ai-agents-connector
More Bilal Naseer vulnerabilities
- TI-2026-63012 WordPress WSP MCP - AI Agents Connector plugin <= 2.7.0 - Broken Access Control vulnerability CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-109382 · CVE Program
- CVE-2026-109382 · NVD
- FIRST EPSS
- GHSA-829v-95xx-xwjh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences