EUVD-2026-85461
GHSA-95hq-cf2h-gc58
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor account on WordPress
-
ExploitSend authenticated request to unprotected plugin action
-
ExecutionBypass missing capability check
-
ImpactModify AI-agent connector state/config
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account at Contributor level or higher on a site running the WSP MCP - AI Agents Connector plugin version 2.7.0 or earlier; the attacker invokes a plugin action that is missing a proper capability/authorization check (CWE-862). Limiting factors: exploitation is not possible unauthenticated (PR:L), it depends on the site both installing this niche AI-agent connector plugin and allowing Contributor-level registration or account access, and impact is confined to integrity (state/configuration modification) with no confidentiality or availability effect. No user interaction is required. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) describes a network-exploitable, low-complexity flaw requiring low privileges - a Contributor-level WordPress account - with no user interaction, yielding high integrity impact but no confidentiality or availability loss. This is a classic CWE-862 missing-authorization (broken access control) issue where an authenticated low-privilege user can invoke functionality reserved for higher roles. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The integrity-only impact (I:H, C:N/A:N) suggests the flaw lets a Contributor modify state or configuration of the AI-agent connector rather than read secrets or crash the site. Real-world priority is moderate-to-low: the CVSS of 6.5 is meaningful but gated behind two limiting factors - the attacker must already hold a valid Contributor account, and the affected plugin is a niche AI/MCP connector with limited deployment. No conflicting signals were found between the vector and description; both consistently indicate authenticated, remote, integrity-focused access control failure. Absence of EPSS/KEV/POC is consistent with a recently disclosed, low-footprint plugin rather than evidence of safety. |
| Exploit ScenarioDerived | An attacker registers or obtains a low-privilege Contributor account on a WordPress site running WSP MCP - AI Agents Connector <= 2.7.0. They send a crafted authenticated request directly to a plugin action that lacks a proper capability check, altering AI-agent connector configuration or state that should be restricted to administrators. No public exploit code is identified, and no user interaction is required beyond the attacker's own authenticated session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Broken access control in the WordPress plugin WSP MCP - AI Agents Connector (versions up to and including 2.7.0) allows any authenticated user holding a Contributor-level account or higher to invoke a plugin action that lacks a proper capability check, modifying plugin state or configuration without authorization. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) confirms this is network-reachable, low complexity, requires low privileges, and needs no user interaction, with high integrity impact but no loss of confidentiality or availability. Exploitation depends on the site running this niche AI-agent connector plugin and permitting Contributor-level registration or account access; no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified in the available data; the fix reference is the Patchstack advisory for the 2.7.0 broken-access-control issue (https://patchstack.com/database/wordpress/plugin/wsp-mcp-ai-agents-connector/vulnerability/wordpress-wsp-mcp-8211-ai-agents-connector-plugin-2-7-0-broken-access-control-vulnerability), so administrators should check that advisory and the plugin's WordPress.org page for a release newer than 2.7.0 and upgrade as soon as one is published. Until a fixed build is available, the most effective action is to deactivate and remove the WSP MCP - AI Agents Connector plugin if AI-agent integration is not actively needed - this eliminates the vulnerable action entirely, at the cost of losing the connector functionality. If the plugin must stay in place, restrict the attack surface by disabling open user registration and requiring administrative approval for new accounts so that untrusted users cannot obtain Contributor-level access, audit existing accounts and remove or downgrade any Contributor (or higher) users who should not have plugin access, and apply WAF or reverse-proxy rules that restrict requests to the plugin's administrative/AJAX/REST endpoints to trusted administrators - noting that URL-based filtering can break legitimate plugin behavior and provides only partial coverage. Also review whether any Contributor-level accounts exist purely by default (for example registration-enabled sites) and tighten the default role assigned to new registrations; monitoring for unexpected changes to plugin settings by low-privileged users is a reasonable detective control given the integrity-only impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability class is CWE-862 (Missing Authorization), and the reported tag "Authentication Bypass" reflects the same root cause: a plugin endpoint or action handler is registered without validating the caller's capabilities. In WordPress, privileged plugin actions (AJAX handlers, REST routes, admin-post callbacks) must call current_user_can() with the appropriate capability before performing state changes; when that check is omitted, any logged-in user - including a Contributor, whose role normally only permits drafting and managing their own posts - can reach functionality intended for administrators. WSP MCP - AI Agents Connector is an AI-agent/Model Context Protocol style connector plugin that exposes agent-facing actions to the WordPress site, which makes authorization on those actions security-critical: they can alter plugin configuration and agent behavior. The affected product is identified in CPE as cpe:2.3:a:bilal_naseer:wsp_mcp_-_ai_agents_connector:*:*:*:*:*:*:*:*, covering all versions at or below 2.7.0, and the same version range is recorded in ENISA EUVD-2026-85461. Because the flaw lives in plugin action registration rather than in WordPress core, the site's role and capability model offers no protection once the plugin is active.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Remote authenticated Contributor (PR:L) exploits a missing authorization check with no user interaction; integrity-only impact per description, so C:N/A:N and I:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB