CVE-2026-39599: WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability

Q: Which installations should be treated as in scope?

WordPress installations using WDS MCP Content Manager version 3.10.4 or earlier should be treated as affected based on the available information.

Q: What access does an attacker need?

The vulnerability requires low-level privileges. The issue is identified as affecting contributor-level access, so an attacker would need a contributor account or equivalent authenticated access.

Q: What impact is indicated if exploited?

The reported impact is limited to integrity, meaning an attacker may be able to make unauthorized changes. No confidentiality or availability impact is indicated by the supplied CVSS vector.

Published Oct 6, 2026

Updated

Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.

Affected Software

1 affected component

WordPress WDS MCP Content Manager<=3.10.4

Event History

Oct 6, 2026

CVE Published

via MITRE·05:14 AM

Data Sourced

via MITRE·05:14 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations should be treated as in scope?

WordPress installations using WDS MCP Content Manager version 3.10.4 or earlier should be treated as affected based on the available information.

What access does an attacker need?

The vulnerability requires low-level privileges. The issue is identified as affecting contributor-level access, so an attacker would need a contributor account or equivalent authenticated access.

What impact is indicated if exploited?