Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.7
CVE-2026-96525: MCP Server for WordPress lets contributors change any workflow
CVE-2026-96525 · published 23 days ago
Summary
The MCP Server for WordPress plugin (versions before 1.8.2) does not verify who owns a workflow before allowing changes through its web API. As a result, users with the Contributor role can create, edit, or delete workflows that affect the whole site, even those set up by administrators. Update the plugin to version 1.8.2 or later, or restrict API access to trusted users until the update can be applied.
What to do
- Update unknown mcp server for wordpress to version 1.8.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | mcp server for wordpress | < 1.8.2 |
Original advisory text
MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflows created by administrators.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.7
Low
Type
CWE-862Missing Authorization
Timeline
Published26 Sep 2026
Updated14 Oct 2026
First seen26 Sep 2026
Track software like this
Free during beta