Authorization Flaw in Royal MCP WordPress Plugin Affects User Data Privacy
CVE-2026-111960
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-111960?
The Royal MCP WordPress plugin prior to version 1.5.10 lacks proper object-level or post-type authorization checks in its search functionality. This oversight enables authenticated users, specifically those with subscriber privileges, to access and disclose titles and contents of non-public entries. Such a breach exposes sensitive personal data managed by the Royal MCP plugin, compromising the privacy and security of affected users.
Affected Version(s)
Royal MCP 1.4.38 < 1.5.10
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.