The MCP Server for WordPress plugin versions before 1.8.2 lacks proper ownership or capability checks on its workflow create, update, and delete REST API routes. This flaw allows users with the Contributor role to modify, delete, and create site-wide workflow configurations, including those created by administrators. The vulnerability has a low CVSS score of 2.7 and does not impact confidentiality or availability but allows limited integrity modification.