{"id":"CVE-2026-96524","title":"The MCP Server for WordPress  WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attacker…","summary":"The MCP Server for WordPress  WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attacker…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-352"],"product":"MCP Server for WordPress","affected":["mcp_server_for_wordpress < 1.8.2"],"published":"2026-09-26","updated":"2026-09-28","sourceUpdated":"2026-09-28T15:17:09.083","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96524","references":[{"url":"https://wpscan.com/vulnerability/d8e97a77-b70f-41f0-8d1e-0d50b6d878c6/","label":"contact@wpscan.com"}],"tags":["nvd","cve.org"],"epss":0.00135,"epssPercentile":0.02928,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-26T22:32:49.495318Z"},"ingestedAt":"2026-09-26T06:27:03.684Z","slug":"CVE-2026-96524","body":"## Overview\n\nThe MCP Server for WordPress  WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a new administrator account, by tricking a logged-in administrator into visiting a crafted page.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":211486,"id":"CVE-2026-96524","ts":1790466014606,"field":"cvss","old":null,"new":"8.8"},{"seq":211485,"id":"CVE-2026-96524","ts":1790466014606,"field":"severity","old":"none","new":"high"}]}