CVE-2026-111961

Name of the Vulnerable Software and Affected Versions Royal MCP WordPress plugin versions prior to 1.5.10

Description An issue exists where the software fails to perform an object-level permission check before duplicating a requested page. By relying on a generic capability, users with contributor-level access can read the full content of any private or draft page and publish it without possessing the required publish capability. This is caused by a missing capability check on a function.

Recommendations Update the plugin to version 1.5.10 or later.