https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T13:29:38.079609+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-96524 fkie_cve-2026-96524 2026-09-29T13:29:38.081349+00:00

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a new administrator account, by tricking a logged-in administrator into visiting a crafted page.

 https://vulnerability.circl.lu/vuln/ghsa-9frx-mgw6-jh42 GHSA-9frx-mgw6-jh42 2026-09-29T13:29:38.081418+00:00

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a new administrator account, by tricking a logged-in administrator into visiting a crafted page.