Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: MCP Server for WordPress 1.8.2 Clear all filters
TI-2026-63795 CVE-2026-96526 · GHSA-fq23-jr6g-77fx

MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route

Priority LOW 13

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publi…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00183 Published 2026-09-26 Fixed in 1.8.2 CWE-200
TI-2026-63794 CVE-2026-96525 · GHSA-cjm9-5j7w-4gvf

MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check

Priority LOW 13

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to m…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00163 Published 2026-09-26 Fixed in 1.8.2 CWE-862
TI-2026-63793 CVE-2026-96524 · GHSA-9frx-mgw6-jh42

MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF

Priority LOW 39

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthen…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00135 Published 2026-09-26 Fixed in 1.8.2 CWE-352