CVE-2026-109382

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wspgetposts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate method accepts any...

EUVD-2026-102794

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wspgetposts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate method accepts any...

CVE-2026-109382

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to and including 2.9.5 . The flaw stems from broken access control where the wsp_get_posts MCP tool is registered with an empty capability requirement, and the authenticate() meth...

CVE-2026-109382 WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wspgetposts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate method accepts any...

CVE-2026-109382 WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wspgetposts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate method accepts any...

CVE-2026-109382: Incorrect Authorization

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wspgetposts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate method accepts any...

WordPress WSP MCP Authorization Issue Vulnerability

WordPress WSP MCP 2.9.5 and earlier versions have an authorization issue. This issue arises from the fact that the permissions requirement is set to empty when the wspgetposts MCP tool is registered. The authenticate method of the MCP endpoint allows arbitrary logged-in users to access it...