All packages
Royal MCP vulnerabilities
3 known CVE vulnerabilities in Royal MCP, translated and rated.
- CVE-2026-54842High
Missing Authorization in Royal Plugins Royal MCP allows exploiting incorrectly configured access control security levels. This issue affects Royal MCP from n/a through 1.4.25.
- CVE-2026-10750High
The Royal MCP WordPress plugin before version 1.4.26 does not perform capability checks on most of its MCP tools after token authentication, allowing authenticated users with low-privileged roles such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.
- CVE-2026-40775High
There is an unauthenticated access control issue in Royal MCP versions <= 1.4.2.