VulnSocial

CVE-2026-9810Disclosure

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (4 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-269

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

  • Public PoC is present in monitored signal
  • 4 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • General: 2 classified signals
  • 4 total mentions across 1 day

Deep dive

Activity timeline4 mentions / 1d
01234Mentions · 2026-07-17: 4PoC Mentioned / Linked · 2026-07-17: 1Technical Details · 2026-07-17: 407-17
Signal classification2 categories
Disclosure
250.0%
General
250.0%
Referenced assets4 URLs
Full discourse4 posts
  • ExploitGrid@exploitgrid
    Disclosure

    🚨 CVSS 9.8 CRITICAL: CVE-2026-9810 — AI Copilot WordPress plugin (<1.5.4) fails to bind OAuth tokens to users. Any unauthenticated attacker completing the public OAuth flow gets full admin access. No creds needed. http://exploitgrid.net/blog #CVE #WordPress #InfoSec https://t.co/IgbIxf3HUw

    Post summary

    The tweet discloses a critical WordPress plugin vulnerability (CVE-2026-9810) that allows unauthenticated attackers to gain full admin rights via OAuth, and links to a blog post for more details.

    01030142
    40 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-9810 The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing u… https://www.cve.org/CVERecord?id=CVE-2026-9810

    Post summary

    The passage describes a privilege escalation flaw in the AI Copilot WordPress plugin where OAuth tokens aren't user-bound, allowing any valid token to gain admin access. No PoC, exploit, patch, or active exploitation claims are present.

    00010638
    57.8K followersView on X
  • ExploitGrid@exploitgrid
    General

    🚨 Critical CVEs today: CVE-2026-9810 (WordPress AI Copilot unauth RCE), CVE-2026-16089 (Keycloak OAuth2 auth code bypass), CVE-2026-15343 (GitHub Dependabot path traversal to RCE), CVE-2026-51082 (Proxmox VE hash dump). Full breakdowns → http://exploitgrid.net #CVE #InfoSec

    Post summary

    The post lists several critical CVEs with succinct descriptions and offers a link for full breakdowns, but contains no statements about exploits, patches, or active attacks.

    0000096
    26 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-9810 The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing u… https://www.cve.org/CVERecord?id=CVE-2026-9810 ----- Traducción: CVE-2026-9810 The… http://infoflow.cloud`

    Post summary

    The statement announces that the AI Copilot WordPress plugin before 1.5.4 fails to bind OAuth tokens to users, enabling any valid token to become an administrator session. No exploit code, patch information, or active exploitation reports are included.

    0000033
    92 followersView on X

Explore more

Back to dashboard