What is GHSA-cjm9-5j7w-4gvf?

GHSA-cjm9-5j7w-4gvf is a security advisory published by GitHub Security Advisories with Low severity. The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or...

Which CVE IDs does GHSA-cjm9-5j7w-4gvf cover?

GHSA-cjm9-5j7w-4gvf covers the following CVE IDs: CVE-2026-96525. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cjm9-5j7w-4gvf?

GHSA-cjm9-5j7w-4gvf has a CVSS v3 base score of 2.7, published by GitHub Security Advisories.

GHSA-cjm9-5j7w-4gvfLowCVSS 2.7

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or...

Vendor

GitHub Security Advisories

Published

September 26, 2026

Last Modified

September 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-96525 →

📋 Description

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflows created by administrators.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-96525
https://wpscan.com/vulnerability/f814fb88-4198-4ba0-972c-658a1d672289
https://github.com/advisories/GHSA-cjm9-5j7w-4gvf