CVE-2026-96524
Received Received - Intake

Unauthenticated Admin Actions via REST API Nonce Bypass in MCP Server for WordPress

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: WPScan

Description
The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a new administrator account, by tricking a logged-in administrator into visiting a crafted page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-96524
EUVD
EUVD-2026-87536

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The MCP Server for WordPress plugin before version 1.8.2 has a vulnerability where it does not properly verify the WordPress REST API nonce for cookie-authenticated requests under certain conditions. This allows unauthenticated attackers to perform actions restricted to administrators, such as creating new administrator accounts, by tricking a logged-in administrator into visiting a malicious page.

Detection Guidance

Check the installed version of the MCP Server for WordPress plugin. If it is below 1.8.2, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

This vulnerability allows attackers to gain full administrative control of a WordPress site without needing valid credentials. If exploited, attackers can create new administrator accounts, modify site content, install malicious plugins, or steal sensitive data. The impact includes complete site compromise and potential data breaches.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized access to personal or health data. GDPR requires protecting personal data, and HIPAA mandates strict controls for health information. A breach via this vulnerability may result in legal penalties, fines, and reputational damage for organizations.

Mitigation Strategies

Update the MCP Server for WordPress plugin to version 1.8.2 or later immediately. Remove any unauthorized administrator accounts created due to the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96524. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart