Tools AI Risk Radar ai-incident-0133
Incident record
Mindio Magic MCP fixes subscriber access to sensitive data
- Severity
- Medium
- Status
- Patched
- Type
- Infra Vuln
- Target
- WordPress Mindio Magic MCP through 0.5.6
- Actor
- researcher
- CVE
- CVE-2026-104402
What happened
A WordPress user with Subscriber privileges can retrieve sensitive data through Mindio Magic MCP. Patchstack published the finding on 2 October; the CVE followed on 4 October. It scores 4.3 Medium under CVSS 3.1.
Version 0.7.1 fixes the exposure. The report concerns authenticated access by a low-privilege account and does not document a monetary loss.
Sources
- Patchstack advisorypatchstack.com/database/wordpress/plugin/mindio-magic-mcp/vu…
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-104402
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026