What’s Vulnerable › Vulnerabilities

CVE-2026-39599: WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-06
• Weakness: CWE-862

Description

Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.

Affected products

• wallstrdev WDS MCP Content Manager: through 3.10.4

References

• https://patchstack.com/database/wordpress/plugin/wds-mcp-content-manager/vulnerability/wordpress-wds-mcp-content-manager-plugin-3-10-4-broken-access-control-vulnerability?_s_id=cve

Get alerted when CVE-2026-39599 or the next vulnerability affects your stack