WDS MCP Content Manager
WDS MCP Content Manager has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for WDS MCP Content Manager has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.
All of these findings were reported by Ananda Dhakal. WDS MCP Content Manager is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.7.
CVE-2026-39599WDS MCP Content Manager <= 3.10.4 - Missing Authorization
Read the full analysisVulnerability Records

WDS MCP Content Manager
Author
wallstrdev
WDS MCP Content Manager connects your WordPress site to AI agents (Claude, Cursor, and other MCP-compatible clients) so they can read, create, and manage your content through natural language prompts. How it works The plugin registers a set of abilities on top of the WordPress MCP Adapter. Once installed, your AI agent can list posts, create content, manage categories and tags, upload images, and more — all without leaving your AI client. Free abilities (no license required) wds/get-posts — List published posts with title, URL, date, and excerpt wds/get-post — Fetch full post content, categories, tags, and SEO meta wds/create-post — Create a post with categories, tags, and featured image wds/update-post — Update any field of an existing post wds/reindex-yoast-seo — Run Yoast SEO data optimization (indexables reindex) after bulk SEO updates wds/get-pages — List pages with URL, status, parent, and template wds/create-page — Create a page with slug, parent, template, and featured image wds/update-page — Update page content, status, slug, hierarchy, and template wds/sync-knowledge-graph — Paginated cursor-based export of all site content as a graph (nodes + edges) — traverse the full site incrementally with delta-sync support wds/get-categories — List all post categories wds/create-category — Create a new post category wds/update-category — Update an existing post category wds/delete-category — Delete an existing post category wds/get-tags — List all post tags wds/create-tag — Create a new post tag wds/update-tag — Update an existing post tag wds/delete-tag — Delete an existing post tag Pro abilities (requires a Pro license) wds/build-content-graph — Build a full site content graph with PageRank scores, internal link analysis, topic clusters, and SEO metadata (supports Yoast, Rank Math, SEOPress, AIOSEO) wds/get-content-insights — Query the content graph for actionable insights: orphaned pages, weak SEO scores, duplicate keyphrases, noindexed content, stale content, top-ranked pages, topic clusters, and internal link gaps wds/get-products — List WooCommerce products with pricing and status wds/get-product — Fetch full WooCommerce product details and taxonomy terms wds/create-product — Create a WooCommerce product with pricing and downloads wds/update-product — Update any field of an existing WooCommerce product wds/get-product-categories — List WooCommerce product categories wds/create-product-category — Create a WooCommerce product category wds/update-product-category — Update a WooCommerce product category wds/delete-product-category — Delete a WooCommerce product category wds/get-product-tags — List WooCommerce product tags wds/create-product-tag — Create a WooCommerce product tag wds/update-product-tag — Update a WooCommerce product tag wds/delete-product-tag — Delete a WooCommerce product tag wds/set-product-schema — Inject JSON-LD structured data into the page head wds/set-elementor-page — Inject a full HTML design via Elementor Canvas wds/inject-elementor-json — Inject native Elementor sections JSON wds/upload-image — Sideload an image from URL into the Media Library wds/set-featured-image — Set or remove the featured image on a post wds/set-post-language — Set Polylang language on a post wds/link-translations — Link posts as Polylang translation pairs wds/set-term-language — Set Polylang language for taxonomy terms wds/link-term-translations — Link taxonomy terms as Polylang translation pairs wds/get-term-translations — Get Polylang translation map for a taxonomy term site-kit/get-top-queries — Returns top Google Search Console queries for the site (requires Google Site Kit plugin) site-kit/get-top-pages — Returns top pages by traffic from Google Analytics 4 (requires Google Site Kit plugin) site-kit/get-page-performance — Returns combined Search Console + GA4 metrics for a single URL (requires Google Site Kit plugin) site-kit/get-traffic-overview — Returns site-wide traffic summary by channel from GA4 (requires Google Site Kit plugin) Pro licenses are available at wallstrdev.de. Requirements WordPress 6.3 or later WordPress MCP Adapter plugin (free, required) WooCommerce — optional, needed for product abilities Elementor — optional, needed for Elementor abilities Polylang — optional, needed for multilingual abilities External Services WordPress MCP Adapter If the WordPress MCP Adapter plugin is not installed, an admin notice offers a one-click install button. Clicking it downloads the adapter from: https://github.com/WordPress/mcp-adapter/releases/latest/download/mcp-adapter.zip This is the official plugin from the WordPress GitHub organisation. The download is triggered only by an explicit admin click — nothing is downloaded automatically. WDS License Server This plugin connects to an external license validation service only when a Pro license key is entered. Service: WDS License Server, operated by Wallstrdev (https://wallstrdev.de) When it is called: – When you save a Pro license key under Settings → WDS MCP Setup → License – Once per day (in the background on admin_init) to revalidate the key What is sent: – Your license key – Your site domain (e.g. example.com) What is NOT sent: post content, user data, personally identifiable information, or site configuration. Why: To confirm the license key is valid for your domain and determine your plan tier (free vs. pro). Data policy: wallstrdev.de/privacy-policy/ Free users (no license key entered) never trigger any external HTTP request. Google Search Console API The Pro abilities site-kit/get-top-queries and site-kit/get-page-performance call the Google Search Console API directly on behalf of the site owner. Service: Google Search Console API, provided by Google LLC (https://searchconsole.googleapis.com) When it is called: Only when an AI agent explicitly invokes the site-kit/get-top-queries or site-kit/get-page-performance Pro ability. Requires the Google Site Kit plugin to be installed, activated, and connected to Search Console. What is sent: – Your Search Console property URL (your site’s domain) – Query parameters: date range, dimensions (query/page), row limit – An OAuth 2.0 Bearer token retrieved from the Site Kit plugin’s stored credentials — no token is stored or transmitted by this plugin What is NOT sent: post content, user data, passwords, or any personally identifiable information beyond the site URL. Why: To retrieve search query and page performance data from Google Search Console so the AI agent can analyse your organic search traffic. Google Terms of Service: https://developers.google.com/terms Google Privacy Policy: https://policies.google.com/privacy Google Analytics Data API The Pro abilities site-kit/get-top-pages, site-kit/get-page-performance, and site-kit/get-traffic-overview call the Google Analytics Data API directly on behalf of the site owner. Service: Google Analytics Data API, provided by Google LLC (https://analyticsdata.googleapis.com) When it is called: Only when an AI agent explicitly invokes one of the above Pro abilities. Requires the Google Site Kit plugin to be installed, activated, and connected to a Google Analytics 4 property. What is sent: – Your GA4 numeric property ID – Query parameters: date range, metrics (sessions, pageviews, etc.), dimensions (pagePath, sessionDefaultChannelGroup, etc.), row limit – An OAuth 2.0 Bearer token retrieved from the Site Kit plugin’s stored credentials — no token is stored or transmitted by this plugin What is NOT sent: post content, visitor PII, passwords, or any data beyond the analytics query parameters listed above. Why: To retrieve traffic and engagement metrics from Google Analytics 4 so the AI agent can summarise your site’s performance. Google Terms of Service: https://developers.google.com/terms Google Privacy Policy: https://policies.google.com/privacy
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C