22 matches found
CVE-2026-111958
The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce,...
CVE-2026-111958 Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token
The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce,...
CVE-2026-111958
The Royal MCP WordPress plugin (versions before 1.5.7 ) is vulnerable to an authentication bypass due to improper handling of preview-link tokens. The plugin fails to restrict a token to the specific preview for which it was originally issued; consequently, any party obtaining a valid token can b...
EUVD-2026-108015
The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce,...
WordPress Royal MCP plugin < 1.4.26 - Subscriber+ Insufficient Authorization in MCP Tools vulnerability
Subscriber+ Insufficient Authorization in MCP Tools vulnerability discovered by Alessandro Greco aka Aleff, Giovanbattista Ianni University of Calabria - UNICAL in WordPress Plugin Royal MCP versions 1.4.26...
CVE-2026-10750
The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenticated users with a low-privileged role such as Subscriber to read private content, enumerate all users and their roles, and create, modify,...
CVE-2026-10750
The Royal MCP WordPress plugin, in versions prior to 1.4.26 , suffers from an insufficient authorization vulnerability. The plugin fails to perform necessary capability checks on the majority of its MCP tools following token authentication. This allows authenticated users with low-privileged role...
CVE-2026-10750: Undefined Security Weakness
The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenticated users with a low-privileged role such as Subscriber to read private content, enumerate all users and their roles, and create, modify,...
PT-2026-54493
The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenticated users with a low-privileged role such as Subscriber to read private content, enumerate all users and their roles, and create, modify,...
CVE-2026-54842
Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25...
EUVD-2026-39387
Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25...
CVE-2026-54842 WordPress Royal MCP plugin <= 1.4.25 - Broken Access Control vulnerability
Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25...
CVE-2026-54842
The CVE describes a Missing Authorization vulnerability in the WordPress Royal MCP plugin (Royal MCP) affecting versions up to 1.4.25. The issue is categorized as Broken Access Control with a CVSS v3.1 base score of 8.1 (HIGH), with network attack vector, low attack complexity, and privileges req...
CVE-2026-54842: Missing Authorization
Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25...
WordPress Royal MCP plugin <= 1.4.25 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by dhamdham in WordPress Plugin Royal MCP versions = 1.4.25...
EUVD-2026-36984
Unauthenticated Broken Access Control in Royal MCP = 1.4.2 versions...
CVE-2026-40775
Unauthenticated Broken Access Control in Royal MCP = 1.4.2 versions...
CVE-2026-40775 WordPress Royal MCP plugin <= 1.4.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Royal MCP = 1.4.2 versions...
