CVE-2026-96524

Summary

The flaw allows unauthenticated attackers to perform administrator-only actions by tricking a logged-in administrator into visiting a crafted page, due to improper verification of the WordPress REST API nonce.

Exploitability

Exploitation is moderately hard as it requires an attacker to influence a condition and trick an administrator, but once triggered, it can lead to full administrator access.

Blast radius

If exploited, the impact is high, as it can result in unauthorized administrative actions, including creating a new administrator account.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to MCP Server for WordPress 1.8.2 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.