The MCP Server for WordPress plugin versions before 1.8.2 contains a vulnerability in the verification of the WordPress REST API nonce for cookie-authenticated requests. This flaw allows unauthenticated attackers to perform actions restricted to administrators by tricking a logged-in administrator into visiting a maliciously crafted page. Such actions include creating new administrator accounts. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery).