Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Royal MCP 1.5.10 Clear all filters
TI-2026-81706 CVE-2026-111961 · GHSA-94r9-pgqm-7rh9

Royal MCP plugin lets contributors read private and draft pages

Priority LOW 17

The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to rea…

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00194 Published 2026-10-28 Fixed in 1.5.10 CWE-639
TI-2026-81705 CVE-2026-111960 · GHSA-334j-cwwv-qmmh

Incorrect authorization in Royal MCP WordPress plugin exposes non-public posts

Priority LOW 19

The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00206 Published 2026-10-28 Fixed in 1.5.10 CWE-863