Airano Mcp Bridge
Monthly
Airano MCP Bridge, a WordPress plugin, ships an MCP bridge action that performs privileged operations without validating the caller's capabilities, so any authenticated low-privilege user (for example a Subscriber) can invoke it and modify data that should be reserved for administrators. The flaw affects all versions up to and including 2.11.0, is remotely reachable over the network with low attack complexity and no user interaction, and is rated CVSS 3.1 base 6.5 with high integrity impact but no confidentiality or availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation is gated on the attacker already holding a valid account on the target site.
Airano MCP Bridge, a WordPress plugin, ships an MCP bridge action that performs privileged operations without validating the caller's capabilities, so any authenticated low-privilege user (for example a Subscriber) can invoke it and modify data that should be reserved for administrators. The flaw affects all versions up to and including 2.11.0, is remotely reachable over the network with low attack complexity and no user interaction, and is rated CVSS 3.1 base 6.5 with high integrity impact but no confidentiality or availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation is gated on the attacker already holding a valid account on the target site.