Tools AI Risk Radar ai-incident-0177
Incident record
IATO MCP exposes changes to low-privilege WordPress users
- Severity
- Medium
- Status
- Research
- Type
- Infra Vuln
- Target
- IATO MCP through 1.12.0
- Actor
- researcher
- CVE
- CVE-2026-32582
What happened
A WordPress user with Contributor privileges could make unauthorised changes through missing permission checks in IATO MCP.
The advisory covers versions through 1.12.0 and scores the flaw 6.5 Medium under CVSS 3.1. Patchstack lists no official patched release.
Sources
- Primary disclosurepatchstack.com/database/wordpress/plugin/iato-mcp/vulnerabil…
- Supporting advisoryraw.githubusercontent.com/CVEProject/cvelistV5/main/cves/202…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026