Live › vulnerability › CVE-2026-111960
Go to dashboardThe Royal MCP WordPress plugin before 1.5.10 has a search tool that skips object-level and post-type authorisation checks. An authenticated user with a low-privilege role such as subscriber can read the title and content of non-public entries, including personal data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Royal MCP WordPress plugin before 1.5.10 where logged-in users, including subscribers, can reach its search tool. Sites without the plugin, or with it already at 1.5.10 or later, are not affected.
No product ranges from the sources yet.
wp plugin get royal-mcp --field=version (unknown whether that slug is exact)1.5.10 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP WordPress plugin before 1.5.10.
This page as .md · .json · in your agent: get_signal("CVE-2026-111960")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.