1805 matches found
CVE-2026-96526
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...
CVE-2026-96524
The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...
WordPress MCP Server for WordPress plugin < 1.8.2 - Contributor+ Workflow Modification and Deletion vulnerability
Contributor+ Workflow Modification and Deletion vulnerability discovered by Raphael P. Cigana in WordPress Plugin MCP Server for WordPress versions 1.8.2...
CVE-2026-96524 MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF
The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...
WordPress MCP Server for WordPress plugin < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure vulnerability
Contributor+ Arbitrary Post Title Disclosure vulnerability discovered by Raphael P. Cigana in WordPress Plugin MCP Server for WordPress versions 1.8.2...
CVE-2026-96524
The MCP Server for WordPress plugin (versions before 1.8.2 ) contains a CSRF vulnerability due to insufficient verification of the WordPress REST API nonce for cookie-authenticated requests. When an attacker influences specific conditions, they can trick a logged-in administrator into visiting a ...
CVE-2026-96525 MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflow...
CVE-2026-96524 MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF
The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...
CVE-2026-96525 MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflow...
EUVD-2026-87538
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...
CVE-2026-96526
The MCP Server for WordPress plugin for WordPress, in versions before 1.8.2 , is susceptible to an authorization vulnerability. The root cause is a lack of object-level authorization checks on one of its workflow REST routes (specifically workflows/run). This flaw allows users with the Contributo...
CVE-2026-96525
The MCP Server for WordPress plugin for WordPress, in versions before 1.8.2 , is vulnerable to unauthorized configuration modification. The root cause is a failure to perform ownership or sufficient capability checks on its workflow create, update, and delete REST routes. This flaw allows users w...
CVE-2026-96526 MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...
CVE-2026-96526 MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...
EUVD-2026-87536
The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...
EUVD-2026-87537
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflow...
WordPress MCP Server for WordPress plugin < 1.8.2 - CSRF to Administrator Account Creation vulnerability
CSRF to Administrator Account Creation vulnerability discovered by Raphael P. Cigana in WordPress Plugin MCP Server for WordPress versions 1.8.2...
MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue
Summary A critical Confused Deputy Arbitrary File Read & Exfiltration vulnerability in the Atlassian MCP server Python allows an AI agent to exfiltrate sensitive host files and environment secrets. By providing absolute system paths to the attachments parameter of the updateissue tool, an agent c...
GHSA-2XJ6-XX86-CWWC MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue
Summary A critical Confused Deputy Arbitrary File Read & Exfiltration vulnerability in the Atlassian MCP server Python allows an AI agent to exfiltrate sensitive host files and environment secrets. By providing absolute system paths to the attachments parameter of the updateissue tool, an agent c...
CVE-2026-61612
creationtimestamp| type| source ---|---|--- 2026-09-22 15:32:08+00:00| seen| https://gist.github.com/alon710/3ba8e1fcc936f8ea3f0b915b4e9e571b 2026-09-22 16:35:02+00:00| published-proof-of-concept| https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-798p-78g2-v556...