CVE-2026-9810 AI Copilot CVE debrief

Who should care

Users of the AI Copilot WordPress plugin, particularly those with administrative privileges, should be aware of this vulnerability and take immediate action to update the plugin to version 1.5.4 or later. Additionally, security teams and vulnerability management teams should review the affected scope and severity of the vulnerability and plan for remediation. Operators of WordPress systems and platforms should also be aware of the potential impact of this vulnerability on their systems.

Technical summary

The AI Copilot WordPress plugin before 1.5.4 does not properly bind OAuth access tokens to a WordPress user. Instead, it accepts any valid token as an administrator session. This insecure implementation allows unauthenticated attackers to complete the public OAuth flow and gain access to privileged MCP tools as an administrator. The vulnerability can be exploited to create arbitrary users and escalate roles. The plugin's insecure implementation is likely due to a lack of proper validation and sanitization of user input.

Defensive priority

High

Recommended defensive actions

• Update the AI Copilot WordPress plugin to version 1.5.4 or later
• Review and restrict access to MCP tools
• Monitor for suspicious user creation and role escalation activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-17T07:16:38.230Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation. Evidence is limited to public sources and may not be comprehensive.

Official resources