CVE-2026-96525: WordPress MCP Server Privilege Escalation

CVE-2026-96525 Overview

CVE-2026-96525 is a missing authorization vulnerability [CWE-862] in the MCP Server for WordPress plugin versions before 1.8.2. The plugin fails to perform ownership or sufficient capability checks on its workflow create, update, and delete REST routes. Users holding only the Contributor role can modify, delete, and create site-wide workflow configurations, including workflows authored by administrators.

The flaw allows a low-privileged authenticated user to tamper with workflow logic shared across the WordPress site. Exploitation requires an existing account but no additional user interaction.

Critical Impact
Authenticated Contributor accounts can overwrite or destroy administrator-created workflow configurations through unprotected REST API routes.

Affected Products

MCP Server for WordPress plugin versions prior to 1.8.2
WordPress sites that grant the Contributor role to untrusted users
Deployments relying on workflow automation managed by this plugin

Discovery Timeline

2026-09-26 - CVE-2026-96525 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-96525

Vulnerability Analysis

The MCP Server for WordPress plugin exposes REST API routes for creating, updating, and deleting workflow configurations. These routes register permission callbacks that validate authentication but do not enforce an ownership check or require a sufficient WordPress capability such as manage_options or edit_others_posts.

As a result, any authenticated user whose role grants REST API access, including the built-in Contributor role, can invoke the workflow endpoints. The server processes the request as if it originated from a privileged user and mutates the shared workflow store.

The impact is limited to integrity of workflow data. Confidentiality is not directly affected, and the vulnerability does not grant arbitrary code execution. However, modified workflows can alter site automation behavior and remove configurations relied upon by administrators.

Root Cause

The root cause is a missing authorization check [CWE-862] in the REST route permission callbacks. The plugin treats presence of a logged-in session as sufficient authorization for workflow mutation operations, rather than evaluating per-object ownership or administrative capability.

Attack Vector

An attacker first obtains or is granted a Contributor-level account. Using the WordPress REST API, the attacker sends authenticated POST, PUT, or DELETE requests to the plugin's workflow endpoints. The server accepts and executes these requests, overwriting or removing workflows created by administrators.

Refer to the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-96525

Indicators of Compromise

Unexpected creation, modification, or deletion of workflow entries in the MCP Server for WordPress plugin configuration
REST API access logs showing Contributor or Author accounts invoking workflow create, update, or delete endpoints
Workflow definitions that no longer match administrator-authored baselines

Detection Strategies

Audit WordPress REST API logs for requests to the plugin's workflow routes originating from non-administrator accounts
Compare current workflow configuration against a known-good backup to identify unauthorized changes
Review WordPress user activity logs for Contributor accounts performing administrative actions

Monitoring Recommendations

Enable REST API request logging at the web server or WAF layer with user identity captured
Alert on any workflow mutation request made by users below the Administrator role
Track plugin version inventory across managed WordPress sites to confirm patch adoption

How to Mitigate CVE-2026-96525

Immediate Actions Required

Upgrade the MCP Server for WordPress plugin to version 1.8.2 or later on all affected sites
Review and restore workflow configurations from a trusted backup if tampering is suspected
Audit the WordPress user base and remove or demote untrusted Contributor accounts

Patch Information

The vendor addressed the vulnerability in version 1.8.2 of the MCP Server for WordPress plugin by enforcing capability and ownership checks on the workflow REST routes. Site administrators should update through the WordPress plugin manager or by deploying the fixed release package. See the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily deactivate the MCP Server for WordPress plugin until the patch is applied
Restrict REST API access to the plugin's workflow routes using a web application firewall rule
Limit account provisioning so that only trusted users receive Contributor or higher roles

bash

# Example WP-CLI command to update the plugin to a fixed version
wp plugin update mcp-server --version=1.8.2