3.8
Low
CVE-2026-111961 The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a…
Description
The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Royal MCP 1.5 | earliest → < 1.5.10 | 1.5.10 |
Other CVEs of Royal MCP
The 4 CVEs of Royal MCP →
CVE-2026-111960
The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one…
4.3
Medium
CVE-2026-111958
The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued…
7.5
High
CVE-2026-10750
The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools…
8.1
High