Description
The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP WordPress plugin before 1.5.10.
Published: 2026-10-28
Score: n/a
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-639

Wed, 28 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Description The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP WordPress plugin before 1.5.10.
Title Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-28T06:00:25.046Z

Reserved: 2026-10-17T17:55:51.498Z

Link: CVE-2026-111960

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T06:16:34.623

Modified: 2026-10-28T06:16:34.623

Link: CVE-2026-111960

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T07:30:11Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-639

    Authorization Bypass Through User-Controlled Key