What happened
CVE-2026-109382 (CVSS 6.5, CWE-863, published 2026-10-16 by Wordfence, verified via NVD REST): the MCP tool lacks a capability requirement and the endpoint accepts any logged-in user, so Subscriber-level accounts can enumerate unpublished content through the agent interface.
Why it matters
A concrete MCP-capability misconfiguration: the same permission that should gate what an AI agent can read is bypassed at the tool-registration level, leaking unpublished/embargoed site content to low-privilege users through the agent bridge.
Attack vector
The wsp_get_posts MCP tool is registered with an empty capability requirement and the MCP endpoint authenticates any logged-in user; the callback honours a caller-supplied status=all argument over publish/draft/pending/future with no ownership filter.
Affected systems
WSP MCP AI Agents Connector for WordPress ≤ 2.9.5
Mitigation
Update the plugin past 2.9.5 (fix changeset 3743711). See Wordfence advisory.