high severity · published 2026-11-15
An incorrect privilege assignment in the MCP Server for WordPress lets an attacker escalate their privileges. With elevated rights they can take actions on the WordPress site they should not be able to perform.
CVE: CVE-2026-125771
Source: NVD
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 3388 and your operating system.