WSP MCP Connector CVE-2026-109382

Requires the WSP MCP AI Agents Connector plugin (<=2.9.5) installed and active with its MCP endpoint reachable, plus a valid authenticated account at Subscriber level or above (the authenticate() method accepts any logged-in user); exploitation is triggered by calling the wsp_get_posts tool with the caller-supplied status=all argument. Limiting factors: an attacker must hold at least Subscriber credentials, so sites that disable open user registration meaningfully reduce exposure; no non-default configuration is otherwise needed since the tool ships with an empty capability requirement. Disclosure is bounded to post metadata and 40-word excerpts, not full post content.

This is a genuine but low-urgency issue, not a drive-by threat. The input CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects network reachability of the MCP endpoint, low attack complexity, and no user interaction, but critically requires PR:L - a valid authenticated account. Per the description the lowest exploitable role is Subscriber, which many WordPress sites expose via open registration, lowering the practical barrier. I disagree with the input's C:H rating: the flaw discloses only metadata (titles, URLs, authors, categories, tags) and 40-word excerpts of unpublished posts, not full draft bodies, so I assess partial confidentiality impact (C:L, ~4.3 Medium) rather than total loss. No EPSS probability, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation-likelihood signals are absent and must be treated as unknown rather than low. Overall this is a targeted information-disclosure bug useful for reconnaissance (leaking embargoed or scheduled editorial content) rather than a critical RCE; patch it in the normal cycle but it does not warrant emergency response absent exploitation evidence.

An attacker registers or obtains a low-privilege Subscriber account on a site running WSP MCP Connector, then invokes the wsp_get_posts MCP tool with status=all. Because the tool has no capability requirement and the endpoint authenticates any logged-in user, the server returns titles, authors, categories and excerpts of every draft, pending and scheduled post, leaking embargoed or confidential editorial content. No public exploit identified at time of analysis.