WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents
wsp-mcp-ai-agents-connector · plugin
Known security vulnerabilities for WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents. Find out in seconds which version runs on your site with WP Lens.
2 known vulnerabilities
latest Oct 16, 2026
Before you install
Known vulnerabilities fixed
- A fixed release exists for all 2 known records (latest 2.9.7).
Install the current version and keep it updated.
This assessment relies only on published vulnerability records and wordpress.org data; it does not review the code.
Is this component installed on your sites, and in which version? See it from inside the site with Noroxi Connector
Listed on wordpress.org · latest 2.9.7 · last updated Oct 29, 2026 · 3K+ installs
wordpress.org status checked on Oct 31, 2026
Vulnerabilities
- Medium 6.5
CVE-2026-109382subscriber+≤ 2.9.5
WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool
- Medium 6.5
CVE-2026-93529contributor+≤ 2.7.0
WordPress WSP MCP - AI Agents Connector plugin <= 2.7.0 - Broken Access Control vulnerability
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).