CVE-2026-96526: MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route

Q: Which users can exploit this issue?

An authenticated user with the Contributor role can exploit the affected workflow REST route. The issue does not require the user to own the target content.

Q: What information can be disclosed?

The route can disclose the title and publication status of posts, pages, and custom post types. This includes content belonging to other users that is private, draft, pending, or scheduled.

Q: Which installations are affected?

MCP Server for WordPress versions earlier than 1.8.2 are affected. The provided information does not state whether any particular WordPress configuration changes the exposure.

Published Sep 26, 2026

Updated

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users' private, draft, pending and scheduled content.

Affected Software

1 affected component

WordPress MCP Server for WordPress<1.8.2

Event History

Sep 26, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

An authenticated user with the Contributor role can exploit the affected workflow REST route. The issue does not require the user to own the target content.

What information can be disclosed?

The route can disclose the title and publication status of posts, pages, and custom post types. This includes content belonging to other users that is private, draft, pending, or scheduled.

Which installations are affected?

MCP Server for WordPress versions earlier than 1.8.2 are affected. The provided information does not state whether any particular WordPress configuration changes the exposure.