WordPress MCP Server REST API Nonce Verification Bypass

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a new administrator account, by tricking a logged-in administrator into visiting a crafted page.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability affects the MCP Server for WordPress plugin versions before 1.8.2, where inadequate nonce verification on REST API endpoints allows unauthenticated attackers to execute privileged administrator actions. The flaw exploits a logic error in cookie-authenticated requests when specific conditions—controllable by an attacker—are met. By crafting a malicious page and socially engineering logged-in administrators to visit it, attackers can create new admin accounts, modify critical settings, or inject malicious code. With a CVSS score of 8.8, this represents a critical authentication bypass that affects any WordPress installation using this plugin, putting sensitive site administration capabilities at risk.

Casky's 323 matching skills leverage Claude's extended reasoning to detect the attack patterns underlying TA0001 (Initial Access) and TA0043 (Reconnaissance) techniques associated with this CVE. Practitioners using Casky would identify suspicious REST API calls lacking proper nonce validation, detecting patterns such as cross-site request forgery (CSRF) attempts against authenticated sessions, anomalous administrator account creation from unexpected sources, and requests exploiting the nonce verification gap. The platform's skill mapping to CWE-352 (Cross-Site Request Forgery) helps security teams recognize when attackers are leveraging social engineering to bypass CSRF protections, surfacing findings that correlate malicious page visits with subsequent privilege escalation activities in WordPress logs and API audit trails.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-96524.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-96524

Casky has 323 skills that investigate the attack patterns behind CVE-2026-96524. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn