WSP MCP: a subscriber account could read every unpublished post

01What happened

Wordfence published CVE-2026-109382 on October 16, 2026 against WSP MCP, a free WordPress plugin that connects Claude, ChatGPT, Cursor and Codex to a site over MCP. Wordfence credits the finding to Wordfence PRISM, its own detection system, and records that the developer was notified on October 13 and the record disclosed on October 15.

02How it works

The wsp_get_posts MCP tool shipped with an empty capability requirement, while the MCP endpoint's authenticate() method accepts any logged-in user. The tool's callback then honours a caller-supplied status=all argument, which widens the query to published, draft, pending and future posts with no author or ownership filter. Wordfence classes the weakness as CWE-863, incorrect authorization.

03Who is affected

Sites running the affected versions are exposed, and the plugin's directory listing reports more than 2,000 active installations. An account at Subscriber level or above is enough, so sites that allow open registration or hand out membership and commenting accounts face the widest exposure. Wordfence records confidentiality impact only, with no ability to change or delete content.

04What to do

Update WSP MCP to 2.9.6, whose changelog describes hardened authorization checks on the post listing, Elementor, Ultimate Addons for Elementor and media upload tools. Review which accounts hold Subscriber access where unpublished posts are sensitive, and check the plugin's audit log for post listing calls made before the update.

Questions people ask

Which WSP MCP version fixes CVE-2026-109382?

WSP MCP 2.9.6 is the release to install. The plugin's changelog labels 2.9.6 a security fix and says authorization checks were hardened on the post listing, Elementor, Ultimate Addons for Elementor and media upload tools. Wordfence lists every version up to and including 2.9.5 as affected, and the plugin directory shows 2.9.6 as the current release.

What could an attacker actually read through the wsp_get_posts tool?

Wordfence states that an attacker with Subscriber access could read the titles, URLs, authors, categories, tags and 40-word excerpts of every unpublished post on the site, covering draft, pending and scheduled content. Published posts were already public. The advisory records confidentiality impact only, with no reported ability to change or delete posts.

Does an attacker need an AI assistant connected to exploit WSP MCP?

No connected assistant is needed. The flaw sits in the plugin's own MCP endpoint, which authenticates any logged-in WordPress user, so a Subscriber account can call the wsp_get_posts tool directly. Sites that allow open registration are reachable by anyone who signs up, whether or not Claude, ChatGPT or another assistant is configured.

Sources 4 links, all fetched

1. 1github.comGitHub Advisory
2. 2cveawg.mitre.orgCVE Record
3. 3wordfence.comWordfence Record
4. 4wordpress.orgPlugin Page