Iato Mcp
Monthly
IATO MCP plugin versions through 1.11.0 contain a missing authorization flaw (CWE-862) that lets an authenticated Contributor-level user perform privileged actions they are not permitted to execute, resulting in high integrity impact but no confidentiality or availability loss (CVSS 6.5). Exploitation requires a valid Contributor account on a WordPress site running the plugin and network access, with no user interaction; no public exploit code or active exploitation has been identified at time of analysis.
IATO MCP plugin versions through 1.11.0 contain a missing authorization flaw (CWE-862) that lets an authenticated Contributor-level user perform privileged actions they are not permitted to execute, resulting in high integrity impact but no confidentiality or availability loss (CVSS 6.5). Exploitation requires a valid Contributor account on a WordPress site running the plugin and network access, with no user interaction; no public exploit code or active exploitation has been identified at time of analysis.