Security issue reported in Software component
The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5.
What happened
- The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any logged-in user, and the wsp_execute_get_posts() callback honouring a caller-supplied status=all argument that expands into a WP_Query over 'publish', 'draft', 'pending' and 'future' posts with no author or ownership filter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the titles, URLs, authors, categories, tags and 40-word excerpts of every unpublished (draft/pending/scheduled) post on the site.Security Advisory CVE-2026-109382
- The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wspgetposts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any logged-in user, and…Advisory description (CVE-2026-109382)
Contributing factors stated by the source
- The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wspgetposts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any logged-in user, and…
The failure pattern
Watch the pattern: AI action exceeds its intended scope
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
- ASI02 Tool Misuse and Exploitation
- ASI03 Identity and Privilege Abuse
- ASI10 Rogue Agents
- LLM03 Excessive Agency
- LLM10 Improper Output Handling
- AC-6 Least Privilege
- SI-10 Information Input Validation
- MAP 5.1 Estimate impacts from past uses and public incident reports
- CWE-250 Execution with Unnecessary Privileges
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
AI coding agent deletes a live production database during a code freeze (Replit, 2025)
An AI coding agent deleted a live production database that held data on more than 1,200 executives and over 1,190 companies.
Airline held liable when its website chatbot gave wrong bereavement-fare advice (Moffatt v. Air Canada, 2024)
A customer relied on Air Canada's website chatbot, which told him he could apply for a bereavement fare retroactively; the airline's policy did not allow that.
Software component issue could run attacker-controlled scripts in a browser
Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the…
Security issue reported in @aborruso/ckan-mcp-server
The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via postMessage.
Security issue reported in Software component
undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before…
Security issue reported in Software component
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the…