CVE-2026-96524 is a CSRF vulnerability in MCP Server for WordPress plugin versions >=0 and <1.8.2. The plugin fails to correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition influenced by an attacker is present. This enables unauthenticated attackers to perform privileged administrator actions by tricking a logged-in administrator into visiting a maliciously crafted page, potentially leading to privilege escalation through the creation of new administrator accounts.

An attacker can exploit this vulnerability to perform administrator-level actions without authentication by leveraging a logged-in administrator's session. This includes the ability to create new administrator accounts, which can lead to full site compromise and persistent unauthorized access.

No patch or official fix information is provided in the available data. Users should upgrade to version 1.8.2 or later once it becomes available, as the vulnerability affects versions prior to 1.8.2. Until a fix is confirmed, administrators should avoid visiting untrusted or suspicious web pages while logged into the WordPress site with administrative privileges. Monitor the vendor advisory for updates on patch availability.