plugin-mcp vulnerabilities
1 known vulnerability in plugin-mcp from PayloadCMS. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
1vulnerabilities
0critical
1high
0exploited
8.6average CVSS score
Latest first
- 8.6 High severity
payload: Missing Authorization
Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeove