CVE-2026-9810
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The AI Copilot WordPress plugin before version 1.5.4 does not bind OAuth access tokens to a WordPress user and accepts any valid token as an administrator session. This allows unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.
Risk Assessment
The organization is at risk of complete WordPress administrator account takeover by an unauthenticated attacker, potentially leading to data theft, content modification, and malware installation.
Recommendation
Immediately update the AI Copilot plugin to version 1.5.4 or later. If an update is not possible, temporarily disable the plugin until the patch is applied.
Original NVD description (English source)
The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.