CVE-2026-111961: Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page

Q: Who can exploit this issue?

A user with contributor-level access or higher can exploit it. The issue affects sites where untrusted or lower-privileged users can authenticate as contributors.

Q: What access does an attacker need?

The attacker needs an authenticated WordPress account with contributor-level access and the ability to invoke the page-duplication functionality. No publish capability is required for the reported bypass.

Q: What content can be exposed or changed?

An affected contributor can read the full content of private or draft pages and duplicate them. They can also publish duplicated content despite not having the publish capability.

Q: Which versions are affected?

Royal MCP versions before 1.5.10 are affected. Updating to version 1.5.10 or later addresses the reported issue.

Q: What can be done if an update cannot be applied immediately?

Restrict or remove contributor access for accounts that are not fully trusted, since contributor-level users are the stated attack prerequisite. Review private and draft pages and published content for unexpected duplicates or unauthorized publication.

Published Oct 28, 2026

Updated

The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capability.

Affected Software

1 affected component

Royal Royal MCP<1.5.10

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with contributor-level access or higher can exploit it. The issue affects sites where untrusted or lower-privileged users can authenticate as contributors.

What access does an attacker need?

The attacker needs an authenticated WordPress account with contributor-level access and the ability to invoke the page-duplication functionality. No publish capability is required for the reported bypass.

What content can be exposed or changed?

An affected contributor can read the full content of private or draft pages and duplicate them. They can also publish duplicated content despite not having the publish capability.

Which versions are affected?

Royal MCP versions before 1.5.10 are affected. Updating to version 1.5.10 or later addresses the reported issue.

What can be done if an update cannot be applied immediately?

Restrict or remove contributor access for accounts that are not fully trusted, since contributor-level users are the stated attack prerequisite. Review private and draft pages and published content for unexpected duplicates or unauthorized publication.

CVE-2026-111961: Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

What content can be exposed or changed?

Which versions are affected?

What can be done if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

What content can be exposed or changed?

Which versions are affected?

What can be done if an update cannot be applied immediately?