WebSamurai
WebSamurai has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for WebSamurai has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.
All of these findings were reported by Ananda Dhakal. WebSamurai is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.10.
CVE-2026-39439WebSamurai <= 1.0.7 - Missing Authorization
Read the full analysisVulnerability Records
WebSamurai
Author
Kiera Howe
WebSamurai brings AI capabilities to your WordPress site through a powerful Model Context Protocol (MCP) server implementation. This plugin provides a secure interface for your AI tools to interact with your WordPress installation. The premium service will allow you to simply type your command on the front-end and it will update your pages or posts or other types based on your prompt. Key Features Model Context Protocol (MCP) Server – HTTP-based MCP server with JSON-RPC 2.0 implementation Secure API Key Authentication – Generate and manage API keys with enterprise-grade security Easy-to-Use Admin Interface – React-based admin panel for managing API keys OAuth Integration – Built-in OAuth support for secure authentication to the remote services Developer-Friendly – Clean, extensible codebase following WordPress coding standards Use Cases Connect Claude Desktop, Claude Code, ChatGPT or your favorite AI Assistant to your WordPress site AI-powered content management Create custom AI tools that interact with WordPress Automate WordPress tasks using AI Run instructions directly from your site Allow your clients an easy interface to AI driven content Technical Highlights JSON-RPC 2.0 over HTTP protocol Stateless HTTP transport (no persistent connections required) API key-based authentication (X-API-Key or Authorization Bearer) Keys prefixed with sk_ followed by 64 hexadecimal characters Standard JSON-RPC error handling Getting Started Install and activate the plugin Navigate to WebSamurai in your WordPress admin menu Generate an API key with a descriptive name Copy your API key immediately (you won’t be able to see it again) Use the API key to connect your AI tools to WordPress Premium Service Sign up for an account on WebSamurai. On your admin panel, Navigate to WebSamurai, OAuth Connection Connect to the server You will now see an “AI” tab on the front of your website that will allow you to make prompts to the AI. The will also be a “Generate Image” on the Media and on the Image block that will allow you to create images. API Endpoints Main MCP Endpoint: /wp-json/websamurai/v1/mcp Server Info: /wp-json/websamurai/v1/mcp/info API Key Management: /wp-json/websamurai/v1/api-keys Claude Desktop Configuration Take a look at https://www.websamurai.io/chatbot_setup/ to see how to setup various chatbots Developer Resources Built with React and WordPress REST API Follows WordPress coding standards Extensible architecture for adding custom tools Comprehensive MCP server implementation Automatic Installation Log in to your WordPress admin panel Navigate to Plugins > Add New Search for “WebSamurai” Click “Install Now” and then “Activate” Manual Installation Download the plugin ZIP file Log in to your WordPress admin panel Navigate to Plugins > Add New > Upload Plugin Choose the ZIP file and click “Install Now” Click “Activate Plugin” Post-Installation Setup Navigate to WebSamurai in the admin menu Generate your first API key Copy the API key and store it securely Configure your AI tools to use the API key Privacy Policy WebSamurai stores API keys in your WordPress database. No data is sent to external servers unless you configure external AI tools to connect to your site. Support For support, documentation, and updates, please visit: * Website: https://websamurai.io * Documentation: Included in plugin (MCP-SERVER.md) Credits WebSamurai is developed and maintained by the WebSamurai team. Built with: * React * WordPress REST API * Model Context Protocol * Babel & Webpack
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C