AI Copilot CVE-2026-9810

Exploitation requires that the target WordPress site has the AI Copilot plugin (version below 1.5.4) installed and active with its public OAuth flow reachable, which is the plugin's intended operating mode. The attacker must complete that public OAuth flow to obtain a valid access token and then call the plugin's MCP tools; no WordPress account, password, or user interaction is needed (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is deployment scope - only sites actually running this specific plugin below 1.5.4 are exploitable - rather than any authentication or configuration barrier.

All strong signals align toward high real-world priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and impact is total (C:H/I:H/A:H) because administrator access equals full site compromise. Publicly available exploit code lowers the barrier to opportunistic mass exploitation of internet-facing WordPress sites. EPSS and SSVC data were not provided in the input, so exploitation-probability and automatability cannot be quantified here - however, the combination of unauthenticated network access, public POC, and a widely automated ecosystem (WordPress) strongly suggests high practical risk. This is not a high-CVSS-but-low-real-risk case; the only mitigating factor is that the vulnerable plugin's install base is far smaller than WordPress core. It is not listed in CISA KEV, so active exploitation is not confirmed.

An attacker discovers an internet-facing WordPress site running AI Copilot below 1.5.4 and completes the plugin's public OAuth flow to obtain any valid access token. Because the token is not bound to a user, the attacker presents it to the MCP tool interface and is treated as an administrator, invoking the user-creation tool to add a new admin account. Publicly available exploit code makes this repeatable and scriptable against many sites with no authentication or user interaction.