CVE-2026-96524

Name of the Vulnerable Software and Affected Versions MCP Server for WordPress versions prior to 1.8.2

Description The plugin fails to correctly verify the WordPress REST API nonce for cookie-authenticated requests under certain conditions. This allows an unauthenticated attacker to perform actions reserved for administrators, such as creating a new administrator account, by tricking a logged-in administrator into visiting a specially crafted page. A nonce is a unique token used to protect against cross-site request forgery (CSRF) attacks.

Recommendations Update the MCP Server for WordPress plugin to version 1.8.2 or later.