Vulnerabilities CVE-2026-9810

CVE-2026-9810

None

Open

TLP:CLEAR

AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth

NVD CVE.org

Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.

Details

EPSS Score ⓘ: 0.30%

22.7th percentile
Confidence: 90%
Published: Jul 17, 2026
Last Modified: Jul 17, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.