CVE-2026-96525lowCWE-862

CVE-2026-96525: low-severity vulnerability in MCP Server for WordPress

MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check

Published

Follow this CVE+ Monitor MCP Server for WordPress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 2.7epss 0.2%
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflows created by administrators.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · MCP Server for WordPress
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — MCP Server for WordPress

In the same product, most dangerous first.

CVE-2026-96526LOWMCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST RouteEPSS 0.2%CVE-2026-96524HIGHMCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRFEPSS 0.1%