Royal MCP CVE-2026-111958

Exploitation requires the attacker to possess a valid Royal MCP preview-link token issued by a vulnerable installation (plugin versions before 1.5.7). The defect is that the token is not bound to the single preview it was issued for, so once held it authenticates the bearer as the token's owning user - an administrator in the default configuration - across the entire REST API with no nonce check. The principal limiting factor is acquiring that valid token (reflected in the CVSS AC:H rating and the PR:L privilege metric); the sources do not state how a token is obtained or how long it remains valid, so the practical ease of acquisition is unverified. No special non-default configuration is noted, and the administrator-equivalence applies specifically to the default setup where the token owner is an admin.

This is a genuine high-severity authentication flaw (CWE-287) but the real-world signals are mixed rather than emergency-grade. The supplied CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) describes a network-reachable issue with full confidentiality, integrity and availability impact - consistent with the description's claim of full site takeover once a token is obtained. However, AC:H and PR:L materially temper the raw impact: the attacker must first acquire a valid preview-link token (AC:H) and the vector indicates some privilege is involved (PR:L), so this is not a trivial drive-by unauthenticated bypass. No EPSS score and no KEV listing were provided, and there is no evidence of active exploitation; the only exploitation signal is a WPScan reference labeled as a PoC reference that is NOT verified as working exploit code. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with the absence of KEV/EPSS data. Net assessment: a credible, patchable priority to remediate on a near-term schedule rather than a confirmed mass-exploitation emergency. Note one tension to verify: the description's phrasing 'any party that obtains a valid token' could read as unauthenticated, yet the vendor-assigned vector uses PR:L - the practical bar is how easily a preview token is obtained, which the sources do not quantify.

An attacker obtains a valid Royal MCP preview-link token (for example one that was shared, leaked, or intercepted) and, because the plugin fails to scope the token to its single intended preview, replays it against arbitrary REST API endpoints with no nonce required. The token authenticates them as its owning user - an administrator in the default configuration - allowing full site takeover. A WPScan PoC reference exists but is not verified as working exploit code, so mass automated exploitation is not demonstrated; the AC:H rating reflects that acquiring a valid token is a non-trivial prerequisite.