The vulnerability arises from the WSP MCP AI Agents Connector plugin's wsp_get_posts tool, which was registered without a capability requirement. The plugin's authentication routine accepts any logged‑in WordPress user, and the execution callback respects a caller‑supplied status=all argument that expands a WP_Query over unpublished post states without author filtering. As a result, authenticated users with Subscriber role or higher can retrieve metadata—titles, URLs, authors, categories, tags, and 40‑word excerpts—from every draft, pending, or scheduled post on the site. This leakage constitutes a sensitive information disclosure of unpublished content, potentially exposing content strategy or confidential data.

The affected product is the WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents, vendor bilalnaseer, for WordPress installations. Versions up to and including 2.9.5 are impacted; the plugin’s capabilities have been revised in later releases to require appropriate permissions for the wsp_get_posts tool. WordPress sites hosting the vulnerable plugin and having any logged‑in subscriber or higher role are vulnerable.

The CVSS score of 6.5 reflects a moderate severity with confidentiality impact; the EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is listed as not present in the CISA KEV catalog. Attackers must be authenticated to a WordPress account with at least Subscriber privileges and then invoke the wsp_get_posts endpoint with status=all—an action that is straightforward once the plugin is enabled. Given the commonality of WordPress sites and the prevalence of the Subscriber role, the potential for data leakage is significant, though no public exploit has been observed.