High severity · published Jul 1, 2026
CVE-2026-10750
Royal MCP < 1.4.26 - Subscriber+ Insufficient Authorization in MCP Tools
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenticated users with a low-privileged role such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RM
Royal MCP ·
before 1.4.26 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10750
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-10750
wpscan.com
https://wpscan.com/vulnerability/8678ef91-ff05-43a1-a8e3-6d35da548826/
More from Royal MCP
7.5
CVE-2026-111958
Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token
–
CVE-2026-111961
Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page
–
CVE-2026-111960
Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability