Contributor-level users on WordPress sites running the MCP Server for WordPress plugin before 1.8.2 can enumerate the title and publication status of any post, page, or custom post type - including other users' private, draft, pending, and scheduled content - by calling a workflow REST route that performs no object-level authorization check. The impact is read-only metadata disclosure (CWE-200): no post bodies, no write access, and no availability impact, and EPSS is 0.14% (3rd percentile) with no KEV listing, though publicly available exploit code exists. Exploitation requires an authenticated account with at least the Contributor role on an affected site, and one metric disagreement is worth flagging: the published CVSS vector rates PR:H (score 2.7) while our independent assessment rates PR:L, matching the publicly documented Contributor-level access path and raising the assessed base score accordingly.
The MCP Server for WordPress plugin before 1.8.2 exposes workflow create, update, and delete REST routes that fail to enforce ownership or sufficient capability checks, allowing an authenticated Contributor-level user to create, modify, or delete site-wide workflow configuration, including workflows originally created by administrators. Attackers need valid low-privilege WordPress credentials but no user interaction and no special configuration beyond an active plugin, making this an integrity-only authorization bypass with no confidentiality or availability impact; publicly available exploit code exists and proof-of-concept details are referenced in the WPScan advisory. EPSS is very low at 0.13% (2nd percentile), CISA SSVC reports no known exploitation, and the vendor has released a fix in 1.8.2.
Cross-site scripting (CWE-79) in the mathurvishal CloudClassroom-PHP-Project, reachable through the queryx parameter of updatequery.php, allows a remote unauthenticated attacker to have arbitrary script execute in a victim's browser session once that victim is induced to open a crafted request. The flaw affects the project through commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be; because the project follows a rolling-release model, no discrete affected or fixed version numbers are published. Publicly available exploit code exists (a GitHub advisory with a stored-XSS write-up) and the vendor did not respond to disclosure, but there is no confirmed actively exploited (CISA KEV) status; EPSS is not reported and the assessed CVSS:3.1 score is 5.3, making this a genuine-but-low-priority issue.
SQL injection in mathurvishal CloudClassroom-PHP-Project lets a low-privilege authenticated remote attacker manipulate the gname or editassid parameters of /updateguest.php to execute arbitrary SQL against the application's backend database, with low confidentiality, integrity and availability impact. Publicly available exploit code exists, and the CVSS 4.0 base score is 5.3 with an E:P (proof-of-concept exploit) temporal qualifier, but there is no evidence of confirmed active exploitation (not in CISA KEV). The practical risk is constrained by the project's niche, self-hosted footprint, the requirement for an authenticated session, and the absence of any vendor fix - the project ships as a rolling release and the maintainer did not respond to the disclosure.
Stored cross-site scripting in mathurvishal's CloudClassroom-PHP-Project allows an authenticated faculty-level user to inject script payloads via the V_Title, V_Url, or V_Remarks arguments of managevideos2.php in the Faculty Video Management component, which then execute in the browser of any other user who views the affected video listing. Exploitation requires a valid account with video-management privileges and a victim who loads the poisoned page, so it is not remotely triggerable by an unauthenticated attacker, and the resulting impact is confined to browser-context script execution with no server-side confidentiality or availability loss. Publicly available exploit code exists, the vendor was contacted but did not respond, the project follows a rolling-release model so no fixed version is identified, and no CISA KEV entry confirms active exploitation.
Session-cancellation authorization bypass in OpenClaw before 2026.8.1 lets an attacker who already holds a valid webhook route secret cancel ACP or subagent TaskFlow work outside that route's configured authority by supplying an arbitrary child session key. The impact is limited to availability - canceled sessions disrupt work but expose no data and modify no state - and exploitation requires the pre-shared route secret plus a valid target session key, so the assessed severity is low (CVSS 4.0 base 2.3; CVSS 3.1 AV:N/AC:H/PR:L/UI:N/C:N/I:N/A:L). No public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV); a vendor patch is available.
Extraction-budget bypass in OpenClaw's tar.bz2 skill installer (npm package 'openclaw', versions 2026.5.28 through 2026.8.0) lets a crafted or compromised skill archive slip prohibited entries past the installer's entry-count and size checks and be extracted in full, persisting over-limit files and inodes in the skill tools directory. The impact is limited to disk-space and inode consumption - archive contents are never executed, and there is no confidentiality or integrity loss - and exploitation requires an operator to explicitly approve installation of the malicious archive (CVSS 4.0 vector PR:N/UI:P; assessed CVSS 3.1 2.3-adjacent, AV:N/AC:H/PR:N/UI:R, A:L only). No public exploit code has been identified at time of analysis, and vendor-released patch: 2026.8.1. This is a low-priority issue where the low CVSS score and the real-world risk agree.
Revoked paired nodes in the OpenClaw npm package (versions 2026.5.12 through 2026.8.1, exclusive) can keep exercising a previously granted Canvas capability over HTTP for the brief close grace period after the operator revokes that node. Only an attacker who already controls a legitimately paired node that was granted Canvas access can benefit, and the impact is bounded to the routes that capability was already configured for - the node gains no new privileges. Exploitation requires a transient race against WebSocket close cleanup (authentication as the paired node, high attack complexity, no victim user interaction), so it is a genuinely low-priority issue with no public exploit identified at time of analysis; OpenClaw 2026.8.1 resolves it.
Durable memory content can leak to an already-admitted but tool-denied sender in the OpenClaw Node.js agent package before version 2026.8.1, because the Active Memory automatic-recall path does not re-apply the originating requester's effective tool policy. When a deployment enables Active Memory and uses toolsBySender rules that explicitly deny a sender access to memory_search and memory_get, deterministic and hidden recall paths can still pull durable memory into the agent's context and surface memory-derived information in the response without any memory tool being invoked. Exploitation requires this non-default combination of Active Memory plus per-sender denials and an attacker who is already admitted to the agent (authenticated, PR:L), with no user interaction; no public exploit code has been identified at time of analysis, and the issue is rated low severity (CVSS 4.0 base 2.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
OpenClaw versions before 2026.8.1 continue to honor memory_search and memory_get tool calls after an operator hot-disables the memory configuration, letting the model inside an already-running agent turn keep reading durable memory for the remainder of that run. Exploitation is authenticated (low privilege, PR:L) and depends on a narrow timing window in which memory is disabled while a previously created memory tool instance is still active, plus passive user interaction; the impact is limited to read-only disclosure of memory content with no writes or availability effect. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and the issue is rated low severity (CVSS 2.1 / assessed CVSS 3.1 vector AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) - a genuinely low-priority issue despite being network-reachable on paper.