CVE-2026-111958
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for. Any party with a valid token is authenticated as the token's owning user (an administrator by default) across the entire REST API without a nonce, leading to full site takeover.
Risk Assessment
Leakage of a preview token allows an attacker to fully take over the WordPress site with administrator privileges.
Recommendation
Update the Royal MCP plugin to version 1.5.7 or later and invalidate existing preview tokens.
Other vulnerabilities in Royal MCP
See all- CVE-2026-10750High
The Royal MCP WordPress plugin before version 1.4.26 does not perform capability checks on most of its MCP tools after token authentication, allowing authenticated users with low-privileged roles such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.
- CVE-2026-54842High
Missing Authorization in Royal Plugins Royal MCP allows exploiting incorrectly configured access control security levels. This issue affects Royal MCP from n/a through 1.4.25.
- CVE-2026-40775High
There is an unauthenticated access control issue in Royal MCP versions <= 1.4.2.
Original NVD description (English source)
The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce, leading to full site takeover.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS