Wsp Mcp Free Mcp Plugin For Wordpress
Monthly
Authenticated users with Subscriber-level access or above can read the titles, URLs, authors, categories, tags, and 40-word excerpts of every unpublished draft, pending, or scheduled post on WordPress sites running the WSP MCP AI Agents Connector plugin through version 2.9.5. The wsp_get_posts MCP tool is registered with an empty capability requirement, the MCP endpoint's authenticate() method accepts any logged-in user, and the tool's callback honors a caller-supplied status=all argument that expands the underlying WP_Query without an author or ownership filter. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the vendor-assigned CVSS of 6.5 is higher than this assessment's estimate (4.3, C:L) because disclosure is bounded to post metadata and short excerpts rather than full post content.
Authenticated users with Subscriber-level access or above can read the titles, URLs, authors, categories, tags, and 40-word excerpts of every unpublished draft, pending, or scheduled post on WordPress sites running the WSP MCP AI Agents Connector plugin through version 2.9.5. The wsp_get_posts MCP tool is registered with an empty capability requirement, the MCP endpoint's authenticate() method accepts any logged-in user, and the tool's callback honors a caller-supplied status=all argument that expands the underlying WP_Query without an author or ownership filter. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the vendor-assigned CVSS of 6.5 is higher than this assessment's estimate (4.3, C:L) because disclosure is bounded to post metadata and short excerpts rather than full post content.