Vulnerability · Published Jul 1, 2026 · Assigned by WPScan
CVE-2026-10750Royal MCP < 1.4.26 - Subscriber+ Insufficient Authorization in MCP Tools
High 8.1
In plain English
A high-severity security flaw in Royal MCP from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 62.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenticated users with a low-privileged role such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.
Affected products (as reported)
References
- https://wpscan.com/vulnerability/8678ef91-ff05-43a1-a8e3-6d35da548826/ exploit, vdb-entry, technical-description