Security Alert Summary
The MCP Server for WordPress plugin before 1.8.2 fails to correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present. This allows an unauthenticated attacker to perform administrator-only actions, such as creating a new administrator account, by tricking a logged-in administrator into visiting a crafted page.
CVE Details
- CVE ID:
CVE-2026-96524 - Affected component: MCP Server for WordPress plugin
- Affected versions: Versions before
1.8.2(versions < 1.8.2) - Published: September 26, 2026 at 7:17 AM
- Last modified: September 26, 2026 at 7:17 AM
- CVSS v3.1: Not provided in CVE metadata
- Authentication / Privileges / User interaction: CVSS details not provided. The description indicates the attacker does not need valid credentials but must trick a logged-in administrator into visiting a crafted page (user interaction required by the victim administrator).
- Primary impact: Integrity – an attacker can perform administrator-only actions, including creating an Administrator account. Confidentiality and availability impacts are not specified in the CVE metadata.
- CWE / weakness ID: Not specified in CVE metadata
Technical Details
The vulnerability stems from incorrect verification of the WordPress REST API nonce for cookie-authenticated requests when a condition that an attacker can influence is present. Because the plugin does not correctly validate the nonce in that scenario, an attacker can craft a request or page that causes a logged-in administrator’s browser to submit actions that the plugin treats as authorized.
According to the advisory language, this can allow unauthenticated attackers to perform administrator-only actions. The description explicitly notes the ability to create a new administrator account by tricking a logged-in administrator into visiting a crafted page. The issue relates to missing or bypassed nonce checks for cookie-authenticated REST interactions rather than a flaw in WordPress core nonce handling.
How This Could Impact Your Website
Consider a site with a site owner, internal staff members who have editor or administrator roles, and an external contractor who contributes content. If an attacker discovers a way to lure a logged-in administrator (for example, by sending a link or embedding content on an external site) and the administrator visits the crafted page, the attacker could cause the site to perform privileged actions without possessing admin credentials.
Practical consequences include the attacker creating additional administrator accounts that persist beyond the initial exploit, increasing the risk of unauthorized changes, and enabling follow-on activities such as targeted phishing or social engineering against staff whose identities or roles become known. Exposure of internal user details or elevated access can also increase the attack surface for future social-engineering campaigns.
professional review may be worth having if you are unsure whether your site is affected or how to assess your current user roles and plugins.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and editor roles that have access to content that could trigger actions.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and audit logs for unusual behavior, such as new administrator accounts or unexpected role changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
