CVE-2026-54842
HighCVSS 8.1Summary
Missing Authorization in Royal Plugins Royal MCP allows exploiting incorrectly configured access control security levels. This issue affects Royal MCP from n/a through 1.4.25.
Risk Assessment
The organization may be exposed to unauthorized access to resources, potentially leading to data leaks or unauthorized changes in the system.
Recommendation
It is recommended to review and improve the configuration of access control levels in Royal MCP to ensure proper user authorization.
Other vulnerabilities in Royal MCP
See all- CVE-2026-10750High
The Royal MCP WordPress plugin before version 1.4.26 does not perform capability checks on most of its MCP tools after token authentication, allowing authenticated users with low-privileged roles such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.
- CVE-2026-40775High
There is an unauthenticated access control issue in Royal MCP versions <= 1.4.2.
Original NVD description (English source)
Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25.