Unscored severity · published Oct 28, 2026
CVE-2026-111960
Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability
New
–
CVSS
–
EPSS
No
On KEV
Description
The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP WordPress plugin before 1.5.10.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RM
Royal MCP ·
1.4.38 before 1.5.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111960
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111960
exploit
https://wpscan.com/vulnerability/474153af-b440-4e89-a27b-131e94c4b63e/
More from Royal MCP
8.1
CVE-2026-10750
Royal MCP < 1.4.26 - Subscriber+ Insufficient Authorization in MCP Tools
7.5
CVE-2026-111958
Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token
–
CVE-2026-111961
Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page