WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents

WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 2 are fixed as of October 2026. Their average CVSS score is 5.4, and the most serious one scores 6.5 out of 10. 2026 was the busiest year with 2 disclosures.

The most common weakness is Incorrect Authorization, behind 1 of the records (50%). Other recurring categories include Missing Authorization.

Every one of the 2 issues recorded for WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.4/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.5CVE-2026-109382

WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool

Read the full analysis

Vulnerability Records

2 records
WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents banner
Latestv2.9.6

WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents

Bilal Naseer

Author

Bilal Naseer

5.0(5)
100/100
Last Updated
2026-10-13 (6d ago)
Active Installs
2,000+
Downloads
14,987
Requires WP
6.9+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2026-07-13 (3mo ago)

WSP MCP is a free MCP plugin for WordPress. It lets AI assistants like Claude, ChatGPT, Cursor, Codex and Antigravity work directly with your website. Ask in plain English and the AI does the work: “Write a blog post about our summer sale and save it as a draft.” “Find every page missing a meta description and suggest one.” “Show me this week’s WooCommerce orders and mark the shipped ones as completed.” “Add a Contact link to the main menu.” Everything is built in. You don’t need another plugin, an account, or any coding. Install it, copy your connection details, paste them into your AI app, and start chatting. You stay in control: every tool has its own on/off switch, anything that changes your site is off until you turn it on, and the AI can only do what its WordPress user is allowed to do. Built and maintained by WebSensePro. Guides and help: wspmcp.com. Watch: set it up in a few minutes What is MCP? MCP (Model Context Protocol) is the standard way AI assistants connect to other apps. Think of it as a plug: once your WordPress site has an MCP plugin, any AI app that supports MCP can read and update your site, with your permission. Why WSP MCP? 100% free. Every feature and every tool, no paid version. Easy to connect. A Connection page with ready-made setup for Claude, Cursor, Codex, Antigravity, OpenClaw and OpenCode, with copy and download buttons. Cursor users can connect in one click. Safe by default. Only read-only tools are on when you install. You pick what else the AI can do. Teach the AI your site. Write an AGENTS.md and CHANGELOG.md once; connected AIs read them first instead of exploring your whole site. See everything the AI did. The Audit Log records every action: what, when, and by whom. Usage dashboard. See how often the AI is used, which tools are most popular, and how fast they respond. Your data stays on your site. Logs and stats are stored in your own database, never sent anywhere. What your AI can do (200+ tools) WordPress basics Posts and pages: read, write, edit, delete Categories and tags Comments: read, approve, delete Media library: browse, upload images, edit titles and alt text Menus: create menus, add or reorder links, assign menu locations Users: list, create, edit Site settings: title, tagline, permalinks Plugins and themes: list, activate, switch Custom post types Site-wide search Works with your favorite plugins (tools appear automatically when the plugin is installed) WooCommerce: products, variations, orders, refunds, coupons, customers, sales reports, low-stock alerts, reviews Yoast SEO and Rank Math: SEO titles, meta descriptions, focus keyphrases Elementor: read and edit page layouts, widgets, global colors and page settings Ultimate Addons for Elementor: widgets, header/footer templates, layouts Advanced Custom Fields: field groups, fields, values, post types, options pages Gravity Forms, Contact Form 7 and WPForms: forms, entries, notifications For safety, the AI can’t add raw code (HTML, JavaScript or CSS) to your pages, and sensitive store tools like refunds and customer data need a shop manager or administrator account.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C