CVE-2026-40775
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
There is an unauthenticated access control issue in Royal MCP versions <= 1.4.2.
Risk Assessment
Organizations may be exposed to unauthorized access to sensitive data or system functions.
Recommendation
It is recommended to upgrade to the latest version of Royal MCP to mitigate this vulnerability.
Other vulnerabilities in Royal MCP
See all- CVE-2026-54842High
Missing Authorization in Royal Plugins Royal MCP allows exploiting incorrectly configured access control security levels. This issue affects Royal MCP from n/a through 1.4.25.
- CVE-2026-10750High
The Royal MCP WordPress plugin before version 1.4.26 does not perform capability checks on most of its MCP tools after token authentication, allowing authenticated users with low-privileged roles such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.
Original NVD description (English source)
Unauthenticated Broken Access Control in Royal MCP <= 1.4.2 versions.