Description

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a new administrator account, by tricking a logged-in administrator into visiting a crafted page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-26T07:17:03.130Z",
  "pubdate": "2026-09-26T07:17:03.130Z",
  "executiveSummary": "The MCP Server for WordPress plugin, specifically versions prior to 1.8.2, contains a critical vulnerability stemming from improper validation of WordPress REST API nonces during cookie-authenticated requests.\nThis vulnerability is classified as a Cross-Site Request Forgery (CSRF) condition that escalates into unauthorized administrative action execution.\nThe flaw allows an unauthenticated attacker to manipulate a logged-in administrator into executing unintended administrative commands by interacting with a malicious, crafted webpage.\nThe primary impact is the complete compromise of the WordPress site, as the attacker can perform privileged actions, such as the unauthorized creation of new administrative-level user accounts.\nSuccessful exploitation requires the victim, who must possess administrative privileges, to visit an attacker-controlled URL while authenticated to the WordPress instance.\nThe vulnerability poses a severe risk to site integrity and confidentiality, as it bypasses intended security controls for REST API endpoint access.",
  "technicalDetails": "The root cause of this vulnerability lies in a failure of the MCP Server plugin to strictly enforce nonce verification when handling REST API requests that rely on cookie-based authentication. In the WordPress security architecture, nonces are essential tokens used to prevent Cross-Site Request Forgery (CSRF) by ensuring that the request is intentional and initiated by the authenticated user from within the legitimate site interface.\nThe plugin improperly validates these tokens under specific conditions that an attacker can influence, effectively nullifying the CSRF protection. When a request is authenticated via session cookies, the REST API endpoints provided by the plugin fail to perform the necessary checks to confirm that the request originated from the expected site context. This allows the REST API to process state-changing actions even when the request is forged by an external, malicious source.\nThe attack flow proceeds as follows: First, the attacker identifies the specific REST API endpoint managed by the MCP Server that executes administrative functions. Second, the attacker crafts a malicious webpage containing a hidden script or automated form submission that targets this specific endpoint. This payload is designed to perform a high-privilege action, such as executing a POST request to 'wp-json/mcp-server/v1/users' or similar, to register a new administrator. Third, the attacker lures a logged-in administrator to this malicious page, typically via social engineering or a booby-trapped link.\nOnce the administrator's browser loads the page, the browser automatically includes the administrator's active session cookies in the request to the target REST API endpoint. Because the plugin does not verify a valid nonce, the WordPress backend treats the request as a legitimate command initiated by the administrator. The server then executes the administrative action—such as creating a new, attacker-controlled administrator account—with the full privileges of the victim. This results in an immediate and total compromise of the WordPress installation, enabling the attacker to maintain persistent backdoor access or perform further malicious operations on the site infrastructure. The vulnerability is present in all versions of the MCP Server for WordPress plugin prior to 1.8.2."
}