---
id: "CVE-2026-111961"
kind: "vulnerability"
aliases: ["CVE-2026-111961"]
title: "Royal MCP WordPress plugin lets contributors copy and publish private pages"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "royal-mcp", "self-hosted", "wordpress"]
not_affected_if: ["no-contributor-accounts", "plugin-1.5.10-or-later", "plugin-absent"]
published_at: "2026-10-28T06:16:34+00:00"
first_seen_at: "2026-10-28T06:31:27+00:00"
updated_at: "2026-10-28T06:32:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111961", "first_seen_at": "2026-10-28T06:31:27+00:00"}]
---

# Royal MCP WordPress plugin lets contributors copy and publish private pages

The Royal MCP WordPress plugin before 1.5.10 duplicates any requested page without checking that the user may access that specific page. A contributor-level account can read the full content of private or draft pages and publish copies of them without holding the publish capability.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Royal MCP plugin version in the WordPress admin plugins list or with `wp plugin get royal-mcp --field=version`
- unknown

## Fix

- Update the Royal MCP plugin to `1.5.10` or later
- unknown

## Timeline

- 2026-10-28T06:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111961

## From the sources

The Royal MCP  WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_