{"id":"CVE-2026-111961","kind":"vulnerability","aliases":["CVE-2026-111961"],"related":[],"title":"Royal MCP WordPress plugin lets contributors copy and publish private pages","description":"The Royal MCP  WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capability.","summary":"The Royal MCP WordPress plugin before 1.5.10 duplicates any requested page without checking that the user may access that specific page. A contributor-level account can read the full content of private or draft pages and publish copies of them without holding the publish capability.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","royal-mcp","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-1.5.10-or-later","plugin-absent"],"how_to_check":"- Check the installed Royal MCP plugin version in the WordPress admin plugins list or with `wp plugin get royal-mcp --field=version`\n- unknown","fix":"- Update the Royal MCP plugin to `1.5.10` or later\n- unknown","status":"open","published_at":"2026-10-28T06:16:34+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:32+00:00","updated_at":"2026-10-28T06:32:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T06:32:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Royal MCP plugin to `1.5.10` or later\n- unknown","reach":"internet","title":"Royal MCP WordPress plugin lets contributors copy and publish private pages","impact":"medium","summary":"The Royal MCP WordPress plugin before 1.5.10 duplicates any requested page without checking that the user may access that specific page. A contributor-level account can read the full content of private or draft pages and publish copies of them without holding the publish capability.","category":"package","nicknames":[],"who_cares":["wordpress","royal-mcp","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Contributors read and publish copies of private or draft pages","analyst_note":"","how_to_check":"- Check the installed Royal MCP plugin version in the WordPress admin plugins list or with `wp plugin get royal-mcp --field=version`\n- unknown","needs_analyst":false,"not_affected_if":["plugin-absent","plugin-1.5.10-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the Royal MCP plugin before `1.5.10` that have contributor-level or other low-privilege user accounts are exposed, because those accounts can reach the page duplication function. Sites without this plugin, or with it at `1.5.10` or later, are not affected. Sites where only administrators and editors hold accounts have a smaller exposure, since those roles already see drafts and private pages.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.0006,"input_tokens":3302,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111961':14A,17A '-2026':13A,16A '1.5.10':32B,78C 'access':43B,105C 'account':51B 'allow':99C 'capabl':71B,97C,125C 'check':38B,87C 'content':56B,110C 'contributor':6A,49B,103C 'contributor-level':48B,102C 'copi':7A,64B 'cve':12A,15A 'draft':60B,115C 'duplic':33B,89C 'full':55B,109C 'generic':96C 'hold':68B,122C 'host':24B 'let':5A 'level':50B,85C,104C 'may':42B 'mcp':2A,21B,28B,74C 'object':84C 'object-level':83C 'packag':18B 'page':11A,36B,46B,61B,92C,116C 'perform':81C 'permiss':86C 'plugin':4A,30B,76C 'privat':10A,58B,113C 'publish':9A,63B,70B,119C,124C 'read':53B,107C 'reli':93C 'request':35B,91C 'royal':1A,20B,27B,73C 'royal-mcp':19B 'self':23B 'self-host':22B 'specif':45B 'user':41B,100C 'without':37B,67B,121C 'wordpress':3A,25B,29B,75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Royal MCP plugin before `1.5.10` that have contributor-level or other low-privilege user accounts are exposed, because those accounts can reach the page duplication function. Sites without this plugin, or with it at `1.5.10` or later, are not affected. Sites where only administrators and editors hold accounts have a smaller exposure, since those roles already see drafts and private pages.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111961","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111961","severity":null,"published_at":"2026-10-28T06:16:34+00:00","modified_at":"2026-10-28T06:16:34+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}