CVE-2026-96524: MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF
The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a new administrator account, by tricking a logged-in administrator into visiting a crafted page.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites running MCP Server for WordPress versions earlier than 1.8.2 are exposed if an administrator is logged in and can be induced to visit an attacker-controlled crafted page.
What does an attacker need to exploit it?
The attacker does not need to be authenticated, but must trick a logged-in WordPress administrator into visiting a crafted page. Exploitation relies on cookie-authenticated requests and an attacker-influenced condition that bypasses proper REST API nonce verification.
What could successful exploitation allow?
An attacker can perform administrator-only actions. The described impact includes creating a new administrator account, which could provide persistent administrative access.
How can I determine whether my site is affected?
Check the installed MCP Server for WordPress plugin version. Versions before 1.8.2 are affected according to the available information.