Authentication Flaw in Royal MCP WordPress Plugin Exposes User Accounts
CVE-2026-111958
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-111958?
The Royal MCP WordPress plugin before version 1.5.7 is susceptible to an authentication bypass due to improper handling of preview-link tokens. This weakness allows an attacker, who acquires a legitimate token, to gain unauthorized access as the original user, typically an administrator, across the entire REST API without requiring a nonce. This lack of access control can lead to complete takeover of the affected site, compromising sensitive information and overall site integrity.
Affected Version(s)
Royal MCP 0 < 1.5.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.