CVE-2026-10750

Royal MCP < 1.4.26 - Subscriber+ Insufficient Authorization in MCP Tools

The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenticated users with a low-privileged role such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.

Affected

Royal MCP

CVSS v3.1 CNA

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.43% chance of exploitation in the next 30 days, 36th percentile

Published

2026-07-01

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/8678ef91-ff05-43a1-a8e3-6d35da548826/

References

• CVE Record
• NVD entry