CVE-2026-109382: WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool
The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wspgetposts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any logged-in user, and the wspexecutegetposts() callback honouring a caller-supplied status=all argument that expands into a WPQuery over 'publish', 'draft', 'pending' and 'future' posts with no author or ownership filter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the titles, URLs, authors, categories, tags and 40-word excerpts of every unpublished (draft/pending/scheduled) post on the site.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. No additional capability is required by the affected MCP tool.
What information can an attacker retrieve?
An attacker can request status=all and retrieve titles, URLs, authors, categories, tags, and 40-word excerpts for unpublished draft, pending, and scheduled posts across the site.
Does exploitation require interaction from another user or special conditions?
No user interaction is required. The attacker needs only a valid logged-in WordPress account and access to the affected MCP endpoint/tool.
How can I determine whether my site is affected?
Sites using WSP MCP AI Agents Connector version 2.9.5 or earlier are affected according to the available data. Confirm the installed plugin version and review whether authenticated low-privilege users can invoke wsp_get_posts with status=all.