CVE-2026-96524 describes a vulnerability in the MCP Server for WordPress plugin prior to version 1.8.2 where the plugin fails to correctly verify the WordPress REST API nonce for cookie-authenticated requests under certain attacker-influenced conditions. This improper verification enables unauthenticated attackers to execute administrator-only actions, such as creating new administrator accounts, by leveraging social engineering to get a logged-in administrator to visit a crafted page. The vulnerability has a CVSS v3.1 score of 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

An attacker can perform administrator-level actions without authentication by exploiting this nonce verification flaw. This includes creating new administrator accounts, which can lead to full site compromise, data theft, and persistent unauthorized access. The vulnerability requires tricking a logged-in administrator into visiting a malicious page, implying social engineering is part of the attack vector.

A fixed version 1.8.2 of the MCP Server for WordPress plugin addresses this vulnerability. Users should upgrade to version 1.8.2 or later to remediate the issue. No other mitigation guidance is provided, and patch status is confirmed by the version numbering in the description. Until upgraded, administrators should be cautious about visiting untrusted pages while logged in.