CVE-2026-96526

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-09-26

Last updated on: 2026-09-28

Assigner: WPScan

Description

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users' private, draft, pending and scheduled content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-26

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-26

EPSS Evaluated

2026-10-14

NVD

CVE-2026-96526

EUVD

EUVD-2026-87538

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	MCP	Server for WordPress 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The MCP Server for WordPress plugin before version 1.8.2 has a flaw where it does not check if users have permission to access certain data. This allows Contributors to view titles and publication status of any post, page, or custom post type, including private, draft, pending, or scheduled content from other users.

Detection Guidance

Check the installed version of the MCP Server for WordPress plugin. If it is below 1.8.2, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

If you use this plugin, an attacker with a Contributor role could access sensitive information about posts they should not see. This includes unpublished or private content, potentially leaking confidential or draft material before it is ready for public release.

Compliance Impact

This vulnerability could lead to unauthorized access to private or sensitive data, which may violate GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using this plugin must ensure proper access controls to maintain compliance.

Mitigation Strategies

Update the MCP Server for WordPress plugin to version 1.8.2 or later immediately. If updating is not possible, consider disabling the plugin until the update is applied.

Hi! I’m here to help you understand CVE-2026-96526. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70