Object-Level Permission Flaw in Royal MCP WordPress Plugin
CVE-2026-111961
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-111961?
The Royal MCP WordPress plugin prior to version 1.5.10 contains an object-level permission check vulnerability. This issue allows users with contributor-level access to duplicate requested pages without appropriate restrictions. Consequently, these users can read the full content of any private or draft page, as well as publish it without the necessary publishing capabilities, potentially exposing sensitive information.
Affected Version(s)
Royal MCP 0 < 1.5.10
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.