CVE-2026-111961

— UNSCORED

Published 2026-10-28 · Updated 2026-10-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capability.

All references

https://wpscan.com/vulnerability/ffdf84e4-dce3-4768-91c9-138256c3064c/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.