Wsp Mcp 8211 Ai Agents Connector
Monthly
Broken access control in the WordPress plugin WSP MCP - AI Agents Connector (versions up to and including 2.7.0) allows any authenticated user holding a Contributor-level account or higher to invoke a plugin action that lacks a proper capability check, modifying plugin state or configuration without authorization. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) confirms this is network-reachable, low complexity, requires low privileges, and needs no user interaction, with high integrity impact but no loss of confidentiality or availability. Exploitation depends on the site running this niche AI-agent connector plugin and permitting Contributor-level registration or account access; no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Broken access control in the WordPress plugin WSP MCP - AI Agents Connector (versions up to and including 2.7.0) allows any authenticated user holding a Contributor-level account or higher to invoke a plugin action that lacks a proper capability check, modifying plugin state or configuration without authorization. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) confirms this is network-reachable, low complexity, requires low privileges, and needs no user interaction, with high integrity impact but no loss of confidentiality or availability. Exploitation depends on the site running this niche AI-agent connector plugin and permitting Contributor-level registration or account access; no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.