Tools AI Risk Radar ai-incident-0134
Incident record
Airano MCP Bridge lets contributors make unauthorised changes
- Severity
- Medium
- Status
- Research
- Type
- Infra Vuln
- Target
- WordPress Airano MCP Bridge through 2.11.0
- Actor
- researcher
- CVE
- CVE-2026-32585
What happened
Missing permission checks in Airano MCP Bridge allow a WordPress user with Contributor privileges to make unauthorised changes. The advisory was published on 2 October and rates the flaw 6.5 Medium under CVSS 3.1.
Patchstack lists no patched version. Its description establishes broken access control, while the exact changes an attacker can make depend on the affected functions.
Sources
- Patchstack advisorypatchstack.com/database/wordpress/plugin/airano-mcp-bridge/v…
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-32585
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026