# WSP MCP: a subscriber account could read every unpublished post

> Wordfence found that WSP MCP's post listing tool accepted any logged-in WordPress user, exposing every unpublished post on the site.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Wordfence
- **Disclosed:** 2026-10-15
- **CVE:** CVE-2026-109382
- **CVSS:** 6.5
- **Affects:** WSP MCP
- **Research by:** Wordfence PRISM
- **Primary source:** https://github.com/advisories/GHSA-829v-95xx-xwjh
- **Page:** https://theinjection.dev/items/wordfence-wsp-mcp-draft-exposure/

WSP MCP, a WordPress plugin that connects Claude and ChatGPT to a site over MCP, registered its post listing tool with no capability check, letting any logged-in subscriber read every draft, pending and scheduled post. Fixed in 2.9.6.

## What happened

Wordfence published CVE-2026-109382 on October 16, 2026 against WSP MCP, a free WordPress plugin that connects Claude, ChatGPT, Cursor and Codex to a site over MCP. Wordfence credits the finding to Wordfence PRISM, its own detection system, and records that the developer was notified on October 13 and the record disclosed on October 15.

## How it works

The wsp_get_posts MCP tool shipped with an empty capability requirement, while the MCP endpoint's authenticate() method accepts any logged-in user. The tool's callback then honours a caller-supplied status=all argument, which widens the query to published, draft, pending and future posts with no author or ownership filter. Wordfence classes the weakness as CWE-863, incorrect authorization.

## Who is affected

Sites running the affected versions are exposed, and the plugin's directory listing reports more than 2,000 active installations. An account at Subscriber level or above is enough, so sites that allow open registration or hand out membership and commenting accounts face the widest exposure. Wordfence records confidentiality impact only, with no ability to change or delete content.

## What to do

Update WSP MCP to 2.9.6, whose changelog describes hardened authorization checks on the post listing, Elementor, Ultimate Addons for Elementor and media upload tools. Review which accounts hold Subscriber access where unpublished posts are sensitive, and check the plugin's audit log for post listing calls made before the update.

## Quick facts

- **Affected:** WSP MCP 2.9.5 and earlier
- **Fixed in:** 2.9.6
- **CVE:** CVE-2026-109382
- **CVSS 3.1:** 6.5 (Wordfence)
- **Found by:** Wordfence PRISM
- **Disclosed:** Developer notified October 13, 2026; disclosed October 15, 2026
- **Attack type:** MCP tool registered with an empty capability requirement, CWE-863

## Questions

### Which WSP MCP version fixes CVE-2026-109382?

WSP MCP 2.9.6 is the release to install. The plugin's changelog labels 2.9.6 a security fix and says authorization checks were hardened on the post listing, Elementor, Ultimate Addons for Elementor and media upload tools. Wordfence lists every version up to and including 2.9.5 as affected, and the plugin directory shows 2.9.6 as the current release.

### What could an attacker actually read through the wsp_get_posts tool?

Wordfence states that an attacker with Subscriber access could read the titles, URLs, authors, categories, tags and 40-word excerpts of every unpublished post on the site, covering draft, pending and scheduled content. Published posts were already public. The advisory records confidentiality impact only, with no reported ability to change or delete posts.

### Does an attacker need an AI assistant connected to exploit WSP MCP?

No connected assistant is needed. The flaw sits in the plugin's own MCP endpoint, which authenticates any logged-in WordPress user, so a Subscriber account can call the wsp_get_posts tool directly. Sites that allow open registration are reachable by anyone who signs up, whether or not Claude, ChatGPT or another assistant is configured.

## Sources

1. [GitHub Advisory](https://github.com/advisories/GHSA-829v-95xx-xwjh)
2. [CVE Record](https://cveawg.mitre.org/api/cve/CVE-2026-109382)
3. [Wordfence Record](https://www.wordfence.com/threat-intel/vulnerabilities/id/809eb78f-fd8e-4434-a36b-bb8e313cf264?source=cve)
4. [Plugin Page](https://wordpress.org/plugins/wsp-mcp-ai-agents-connector/)