Royal MCP CVE-2026-10750

Exploitation requires an authenticated, token-authenticated MCP session tied to a valid WordPress account of any role, including the lowest-privileged Subscriber (per CVSS PR:L). The specific enabling condition is that the Royal MCP plugin is installed, active, and at a version below 1.4.26, and that its MCP tools are reachable - the flaw triggers because capability checks are absent on most tools once the MCP token is validated. Limiting factors: the attacker must first hold a low-privileged account and a working MCP token, so sites that disable open user registration and tightly control token issuance materially raise the bar; no user interaction is needed and no admin privileges are required once that foothold exists. SSVC Automatable=no reflects that each target needs its own valid account rather than untargeted mass exploitation.

Signals are largely consistent and point to a genuine priority for sites running this plugin. CVSS 8.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:H) reflects network-reachable, low-complexity abuse requiring only a low-privileged authenticated account and no user interaction, with high confidentiality and integrity impact - matching the description exactly. SSVC aligns: Technical Impact = total and Exploitation = poc, but Automatable = no, indicating each target requires a valid low-priv account rather than spray-and-pray mass exploitation. A public exploit exists (WPScan), which raises practical risk, but there is no CISA KEV listing and no EPSS score was provided, so widespread active exploitation is not established. The main gating factor is that the attacker must first hold or obtain a Subscriber-level account - trivial on sites with open registration, a real barrier on locked-down sites. No CWE was supplied in the input; the CWE class stated above is inferred from the description, not vendor-assigned.

An attacker registers or obtains a Subscriber account on a WordPress site running Royal MCP < 1.4.26 and authenticates to the MCP interface with a token. Because capability checks are missing, they invoke MCP tools to dump all usernames and roles, read private/draft posts, and delete or tamper with other users' content - all without any admin privileges. A public exploit is available from WPScan, making this straightforward to reproduce given a low-privileged foothold.