PT-2026-127837

CVE-2026-111960

Published

2026-10-28

Updated

2026-10-28

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Royal MCP WordPress plugin versions 1.4.38 through 1.5.10

Description Authenticated users with subscriber-level access and above can disclose the title and content of non-public entries, including personal data. This occurs because the plugin fails to perform object-level or post-type authorization checks in one of its search tools due to a missing capability check on a function.

Recommendations Update Royal MCP WordPress plugin to version 1.5.10 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vincent Cassiau

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

Related identifiers