CVE-2026-111958: Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token
The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce, leading to full site takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Royal MCPto a version that resolves this vulnerability.Fixed in 1.5.7
Event History
Frequently Asked Questions
Who is exposed to full site takeover?
Sites running Royal MCP versions before 1.5.7 are exposed if a valid preview-link token is obtained. In the default configuration, the token owner is an administrator, so the token authenticates an attacker as an administrator.
What does an attacker need to exploit this issue?
The attacker needs a valid preview-link token. No nonce is required, and the token can be used across the entire REST API rather than only for the preview it was issued for.
Is the default configuration affected?
Yes. The default configuration assigns the preview-link token to an administrator, which allows a holder of that token to authenticate with administrator-level access.