Bilal Naseer vulnerabilities and threats

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.5	EPSS 0.3%	CVE-2026-109382WSP MCP (WordPress plugin) · Incorrect Authorization Medium6.5EPSS 0.3%2026-10-16CVE Database V5CVE-2026-109382 The WSP MCP AI Agents Connector plugin for WordPress versions up to 2.9.5 has an authorization vulnerability that allows authenticated users with Subscriber-level access or higher to access sensitive information. Specifically, these users can retrieve titles, URLs, authors, categories, tags, and excerpts of all unpublished posts, including drafts, pending, and scheduled posts. This occurs because the plugin's endpoint accepts any logged-in user and does not restrict access based on post ownership or author. EPSS 0.3%Vulnerability bilalnaseer CWE-863	CVE Database V5	2026-10-16
Medium	6.5	EPSS 0.3%	CVE-2026-93529WSP MCP – AI Agents Connector (WordPress plugin) · Missing Authorization Medium6.5EPSS 0.3%2026-09-23CVE Database V5CVE-2026-93529 Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions. EPSS 0.3%Vulnerability Bilal Naseer CWE-862 #ghsa-95hq-cf2h-gc58	CVE Database V5	2026-09-23

Page 1 of 1