Filtered by vendor Wordpress-extensions Subscriptions
Filtered by product Ai Copilot Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-9810 1 Wordpress-extensions 1 Ai Copilot 2026-11-10 9.8 Critical
The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.