EUVD-2026-92953
GHSA-5gj8-cw8v-rrcx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Contributor user
-
ExploitInvoke plugin action lacking authorization check
-
ExecutionPerform unauthorized content modification
-
ImpactLimited integrity impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with at least Contributor-level privileges on a site running WDS MCP Content Manager version 3.10.4 or earlier; no user interaction is needed (UI:N) and the vulnerable action is reachable over the network (AV:N). The key limiting factor is the Contributor authentication requirement (PR:L) - the attacker must already have, or be able to self-register, a Contributor account, confining exploitation to multi-author or open-registration sites. Impact is bounded to a limited integrity change (I:L) with no confidentiality or availability consequence, further reducing realistic risk. |
| Impact | This is a low-to-moderate priority issue despite the 'Authentication Bypass' tag. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and CWE-862 (Missing Authorization) describe a broken access control flaw requiring an authenticated Contributor-level account (PR:L), with only a limited integrity impact and no confidentiality or availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'Authentication Bypass' tag conflicts with the underlying data: PR:L and the 'Contributor Broken Access Control' title indicate this is a privilege/authorization enforcement gap for already-authenticated low-privilege users, not a true pre-authentication bypass - treat the tag as loose labeling, not confirmed capability. The combination of required authentication, integrity-only limited impact, and obscure plugin footprint makes this a routine WordPress plugin hardening item rather than an urgent threat, though multi-author sites that freely grant Contributor accounts should still patch promptly. |
| Exploit ScenarioDerived | An attacker who holds or registers a low-privilege Contributor account on a WordPress site running WDS MCP Content Manager <= 3.10.4 invokes a plugin action that lacks a proper capability or authorization check. Because only PR:L is required and no user interaction is needed, the Contributor manipulates content or state they should not be permitted to touch, yielding a limited integrity impact. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Missing authorization checks in the WordPress plugin WDS MCP Content Manager (versions up to and including 3.10.4) let an authenticated Contributor-level user invoke functionality that should be reserved for higher-privileged roles, enabling limited unauthorized modification of plugin-managed content and settings. Exploitation requires only a Contributor account - a role that is trivially obtained on multi-author blogs and sites with open registration - needs no user interaction, and is reachable over the network, but the resulting impact is confined to a low-integrity change with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and the 'Authentication Bypass' tag is somewhat overstated: this is an authenticated privilege/authorization gap, making it a low-to-moderate priority issue rather than a critical one.
RemediationAI
No vendor-released patch identified at time of analysis - no fixed version number appears in the available data, so the immediate action is to monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wds-mcp-content-manager/vulnerability/wordpress-wds-mcp-content-manager-plugin-3-10-4-broken-access-control-vulnerability?_s_id=cve) and the plugin's WordPress.org page, and to upgrade to the first release above 3.10.4 as soon as it ships. Until then, apply targeted compensating controls: if the MCP/MCP-style content workflows are not in active use, deactivate and delete the plugin, accepting the loss of that functionality as the trade-off; if the plugin must stay live, disable open user registration and stop assigning the Contributor role by default (Settings → General), where the side effect is that legitimate self-service contributor onboarding breaks and must be handled manually; audit existing Contributor accounts and demote or remove any that are not genuinely needed, acknowledging that this does not stop an attacker who can self-register before registration is closed. A virtual-patch or WAF rule that restricts the plugin's content-management endpoints to Editor/Administrator sessions can reduce exposure, but it is a stopgap that may not cover every vulnerable code path and requires ongoing rule maintenance. Finally, revoke and rotate any credentials or tokens those Contributor accounts held, since the flaw permits unauthorized state changes rather than credential theft.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-39599 is a CWE-862 (Missing Authorization) defect in the WordPress plugin WDS MCP Content Manager, a content-management extension built around MCP-style (Model Context Protocol) content operations. In WordPress, action-level authorization is normally enforced by pairing capability checks such as current_user_can() with nonce validation on AJAX handlers, REST routes, and admin-post actions. When those checks are absent or incomplete, a lower-privileged role can reach a code path it was never meant to reach - the classic CWE-862 pattern. The CPE cpe:2.3:a:wallstrdev:wds_mcp_content_manager:*:*:*:*:*:*:*:* identifies the affected component as the wallstrdev/WDS plugin and, with the version wildcard, indicates the flaw is version-agnostic up to the fixed release. Because the plugin exposes content-management workflows to programmatic clients, its endpoints are reachable over the network (AV:N) and require only low privileges (PR:L) with no user interaction (UI:N), but per the assessed vector the scope remains unchanged (S:U) and the effect is limited to integrity (I:L) with C:N/A:N - the missing authorization permits state changes, not data exfiltration or denial of service.
Know when Wds Mcp Content Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Contributor account required so PR:L not PR:N; network-reachable with no interaction (AV:N/AC:L/UI:N); missing authorization yields limited integrity change only (I:L, C:N/A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB