4.3
Moyenne
CVE-2026-111960 The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one…
Description
The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP WordPress plugin before 1.5.10.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Royal MCP 1.4 | 1.4.38 → < 1.5.10 | 1.5.10 |
Autres CVE de Royal MCP
Les 4 CVE de Royal MCP →
CVE-2026-111961
The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a…
3.8
Faible
CVE-2026-111958
The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued…
7.5
Élevée
CVE-2026-10750
The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools…
8.1
Élevée