3.8
LowCVSS 3.1 · from CISA
CVE-2026-111961
Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page
Royal MCP · Authorization bypass via user key · CWE-639AffectedRoyal MCP
FixUpdate to 1.5.10 or newer
PublishedOct 28, 06:00 · WPScan
Scored3.8 · CISA
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:04 UTC
What we know
No known exploitation. CISA KEV, checked 22:04 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
Description
The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capability.
From WPScan
Affected and fixed versions
ProductAffectedFixed inRoyal MCPbefore 1.5.101.5.10
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known