What is the CVSS score of CVE-2026-9810?

CVE-2026-9810 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of AI Copilot are affected by CVE-2026-9810?

The AI Copilot WordPress plugin (versions before 1.5.4) allows unauthenticated attackers to gain full administrative control of affected WordPress sites by exploiting improper OAuth token binding,…. A patch is available.

Is there a public PoC exploit available for CVE-2026-9810?

Yes, a public proof-of-concept exploit is available for CVE-2026-9810. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-9810?

Within 24 hours: identify and update all WordPress instances running AI Copilot plugin to version 1.5.4 or later; disable the plugin on systems awaiting updates. Within 7 days: review server access logs and WordPress audit trails for suspicious OAuth token flows and unauthorized administrator account creation; force password resets for all privileged accounts. Within 30 days: conduct a comprehensive security review of OAuth and token-binding implementations across your WordPress environment and establish automated monitoring for privilege escalation attempts.

AI Copilot CVE-2026-9810

EUVD-2026-45150 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-17 WPScan

GHSA-74px-22jg-8gh2

WordPress Privilege Escalation Ai Copilot Unknown

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Public OAuth flow gives unauthenticated network access with no user interaction (AV:N/AC:L/PR:N/UI:N), and administrator takeover yields total confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 13:23 vuln.today

CVSS changed

Jul 17, 2026 - 13:22 NVD

9.8 (CRITICAL)

Patch available

Jul 17, 2026 - 08:02 EUVD

CVE Published

Jul 17, 2026 - 06:00 cve.org

CRITICAL 9.8

CVE Published

Jul 17, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.

Articles & Coverage 1

News Critical Privilege Escalation in WordPress AI Copilot Plugin - CVE-2026-9810 Jul 17, 2026

AnalysisAI

Privilege escalation and full site takeover affects the AI Copilot WordPress plugin before 1.5.4, which fails to bind OAuth access tokens to a specific WordPress user and treats any valid token as an administrator session. An unauthenticated attacker who completes the plugin's public OAuth flow can invoke privileged MCP (Model Context Protocol) tools as an administrator, creating new users and escalating roles. Publicly available exploit code exists and the flaw carries a CVSS 9.8; no active exploitation has been confirmed (not in CISA KEV).

Technical ContextAI

The affected component is the AI Copilot plugin's integration between OAuth 2.0 authorization and its MCP (Model Context Protocol) tool interface within WordPress. The root cause maps to CWE-269 (Improper Privilege Management): access tokens issued through the public OAuth flow are never bound to the identity of a WordPress user, so the server accepts any structurally valid token as if it belonged to an administrator. Because MCP tools expose privileged operations (user creation, role assignment), the missing token-to-principal binding collapses the authorization boundary - the plugin authenticates that a token is valid but never authorizes it against a user or role. The CPE cpe:2.3:a:unknown:ai_copilot:*:*:*:*:*:*:*:* covers all versions prior to the fix.

RemediationAI

Vendor-released patch: upgrade the AI Copilot plugin to version 1.5.4 or later, which binds OAuth tokens to the authenticated WordPress user. Until the upgrade is applied, deactivate and remove the AI Copilot plugin entirely, since the OAuth flow is publicly reachable and cannot be safely left enabled; if the plugin must remain active, restrict network access to its OAuth and MCP endpoints (for example via a WAF rule or web-server access control limiting those paths to trusted IPs), accepting that this breaks legitimate OAuth-based clients. After patching, audit the WordPress user table for unexpected administrator accounts or recent role changes and rotate credentials, as the flaw permits arbitrary user creation. Advisory references: WPScan (https://wpscan.com/vulnerability/6378a370-fe2f-48e7-984f-6e6c575dba60/), EUVD/NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-9810), and VulDB (https://vuldb.com/vuln/379767).