EUVD-2026-87537
GHSA-cjm9-5j7w-4gvf
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Exploitable by a low-privilege Contributor account over the network with no interaction (PR:L, not PR:H); only workflow-config integrity is affected, so I:L and C/A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflows created by administrators.
AnalysisAI
The MCP Server for WordPress plugin before 1.8.2 exposes workflow create, update, and delete REST routes that fail to enforce ownership or sufficient capability checks, allowing an authenticated Contributor-level user to create, modify, or delete site-wide workflow configuration, including workflows originally created by administrators. Attackers need valid low-privilege WordPress credentials but no user interaction and no special configuration beyond an active plugin, making this an integrity-only authorization bypass with no confidentiality or availability impact; publicly available exploit code exists and proof-of-concept details are referenced in the WPScan advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account with at least the Contributor role on a site running MCP Server for WordPress before 1.8.2; the plugin's workflow create/update/delete REST routes perform no ownership or capability check. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-real-risk, authenticated authorization flaw despite the eye-catching 'Authentication Bypass' tag. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the MCP Server for WordPress plugin to version 1.8.2 or later, which is the vendor-released patch that adds the missing ownership and capability checks on the workflow create, update, and delete REST routes; this is the primary and recommended fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today