CVE-2026-96526lowCWE-200

CVE-2026-96526: low-severity vulnerability in MCP Server for WordPress

MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route

Published

Follow this CVE+ Monitor MCP Server for WordPress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 2.7epss 0.2%
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users' private, draft, pending and scheduled content.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · MCP Server for WordPress
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — MCP Server for WordPress

In the same product, most dangerous first.

CVE-2026-96525LOWMCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership CheckEPSS 0.2%CVE-2026-96524HIGHMCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRFEPSS 0.1%