CyberRota Analysis
AI-GeneratedThe MCP Server for WordPress plugin prior to version 1.8.2 is vulnerable due to a lack of object-level authorization checks on its workflow REST routes, enabling users with the Contributor role to access sensitive information such as the titles and publication statuses of all posts, including private and draft content from other users. This vulnerability poses a significant risk to content confidentiality within WordPress sites. WordPress administrators and site owners should prioritize updating this plugin to mitigate potential data exposure risks.
Original NVD Description
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users' private, draft, pending and scheduled content.