Live › vulnerability › CVE-2026-111961
Go to dashboardThe Royal MCP WordPress plugin before 1.5.10 duplicates any requested page without checking that the user may access that specific page. A contributor-level account can read the full content of private or draft pages and publish copies of them without holding the publish capability.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Royal MCP plugin before 1.5.10 that have contributor-level or other low-privilege user accounts are exposed, because those accounts can reach the page duplication function. Sites without this plugin, or with it at or later, are not affected. Sites where only administrators and editors hold accounts have a smaller exposure, since those roles already see drafts and private pages.
1.5.10No product ranges from the sources yet.
wp plugin get royal-mcp --field=version1.5.10 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capability.
This page as .md · .json · in your agent: get_signal("CVE-2026-111961")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.