CVE-2026-109382

Medium · CVSS 6.5 (NVD) · fetched 2026-11-01

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any logged-in user, and the wsp_execute_get_posts() callback honouring a caller-supplied status=all argument that expands into a WP_Query over 'publish', 'draft', 'pending' and 'future' posts with no author or ownership filter.

Remediation

Apply the updates and mitigations in the source advisory; if no fix is available, follow the advisory's guidance on restricting or discontinuing use.

Affected PHP branches

See the source advisory.

Check your site

Source: NIST National Vulnerability Database (NVD) · retrieved 2026-11-01T15:20:15-05:00 · https://nvd.nist.gov/vuln/detail/CVE-2026-109382

← All threats