CVE-2026-54842
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Missing Authorization in Royal Plugins Royal MCP allows exploiting incorrectly configured access control security levels. This issue affects Royal MCP from n/a through 1.4.25.
Risk Assessment
The organization may be exposed to unauthorized access to resources, potentially leading to data leaks or unauthorized changes in the system.
Recommendation
It is recommended to review and improve the configuration of access control levels in Royal MCP to ensure proper user authorization.
Other vulnerabilities in Royal MCP
See all- CVE-2026-111958High
The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for. Any party with a valid token is authenticated as the token's owning user (an administrator by default) across the entire REST API without a nonce, leading to full site takeover.
- CVE-2026-10750High
The Royal MCP WordPress plugin before version 1.4.26 does not perform capability checks on most of its MCP tools after token authentication, allowing authenticated users with low-privileged roles such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.
- CVE-2026-40775High
There is an unauthenticated access control issue in Royal MCP versions <= 1.4.2.
Original NVD description (English source)
Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS