Unscored severity · published Oct 28, 2026
CVE-2026-111961
Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page
New
–
CVSS
–
EPSS
No
On KEV
Description
The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capability.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RM
Royal MCP ·
before 1.5.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111961
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111961
exploit
https://wpscan.com/vulnerability/ffdf84e4-dce3-4768-91c9-138256c3064c/
More from Royal MCP
8.1
CVE-2026-10750
Royal MCP < 1.4.26 - Subscriber+ Insufficient Authorization in MCP Tools
7.5
CVE-2026-111958
Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token
–
CVE-2026-111960
Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability