Threat database

The WSP MCP AI Agents Connector plugin for WordPress versions up to 2.9.5 has an authorization vulnerability that allows authenticated users with Subscriber-level access or higher to access sensitive information. Specifically, these users can retrieve titles, URLs, authors, categories, tags, and excerpts of all unpublished posts, including drafts, pending, and scheduled posts. This occurs because the plugin's endpoint accepts any logged-in user and does not restrict access based on post ownership or author.