Tools AI Risk Radar ai-incident-0178
Incident record
WDS MCP exposes content actions to low-privilege WordPress users
- Severity
- Medium
- Status
- Research
- Type
- Infra Vuln
- Target
- WDS MCP Content Manager through 3.10.4
- Actor
- researcher
- CVE
- CVE-2026-39599
What happened
A WordPress user with Contributor privileges could access actions beyond their intended permissions in WDS MCP Content Manager.
The advisory covers versions through 3.10.4 and scores the flaw 4.3 Medium under CVSS 3.1. Patchstack lists no official patched release.
Sources
- Primary disclosurepatchstack.com/database/wordpress/plugin/wds-mcp-content-man…
- Supporting advisoryraw.githubusercontent.com/CVEProject/cvelistV5/main/cves/202…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026