High severity · published Oct 22, 2026
CVE-2026-111958
Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token
New
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce, leading to full site takeover.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RM
Royal MCP ·
before 1.5.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111958
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111958
wpscan.com
https://wpscan.com/vulnerability/014f061c-54f3-491e-b4a0-85cfa6fb178b/
More from Royal MCP
8.1
CVE-2026-10750
Royal MCP < 1.4.26 - Subscriber+ Insufficient Authorization in MCP Tools
–
CVE-2026-111961
Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page
–
CVE-2026-111960
Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability