What is the CVSS score of CVE-2026-54842?

CVE-2026-54842 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Royal MCP are affected by CVE-2026-54842?

The Royal MCP WordPress plugin (versions ≤1.4.25) contains a broken access control vulnerability enabling authenticated low-privilege users to access and modify restricted functionality and data.

How to fix or mitigate CVE-2026-54842?

24 hours: Audit WordPress infrastructure to identify installations using Royal MCP plugin; disable the plugin immediately if non-critical, or restrict access to trusted administrators only. 7 days: Review access logs for suspicious activity from low-privilege accounts; implement additional user role segmentation to minimize exposure of sensitive functionality. 30 days: Monitor vendor advisories for patch availability; evaluate alternative plugins or solutions if patching timeline remains undefined.

Royal MCP CVE-2026-54842

EUVD-2026-39387 HIGH

Missing Authorization (CWE-862)

2026-06-25 Patchstack

GHSA-7649-6hf2-rxrp

WordPress Authentication Bypass Wordpress Plugin Royal Mcp

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable, low complexity, no interaction; PR:L because a logged-in low-privilege account is required; high C/I from unauthorized data read and modification, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:25 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Royal MCP: from n/a through 1.4.25.

AnalysisAI

Broken access control in the Royal MCP WordPress plugin (versions up to and including 1.4.25) lets authenticated low-privilege users reach functionality that should be restricted, due to a missing authorization check. With a CVSS of 8.1 and high confidentiality and integrity impact, an attacker holding even a basic account can read and alter data they should not be able to touch. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Royal MCP is a WordPress plugin from Royal Plugins that exposes Model Context Protocol (MCP) style functionality within the WordPress environment. The root cause is CWE-862 (Missing Authorization): one or more plugin actions or endpoints perform their work without verifying that the calling user has the capability or role required for that operation. In WordPress plugins this class of bug typically stems from registering AJAX/REST handlers or MCP tool actions without a proper current_user_can() capability check or nonce-bound authorization gate, so the security boundary collapses to merely 'is logged in' rather than 'is authorized.' The CPE cpe:2.3:a:royal_plugins:royal_mcp:*:*:*:*:*:*:*:* confirms the affected component is the Royal MCP plugin across all versions through 1.4.25.

RemediationAI

No vendor-released patch version is identified at time of analysis; the data only confirms versions through 1.4.25 are affected, so administrators should monitor the Royal Plugins changelog and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/royal-mcp/vulnerability/wordpress-royal-mcp-plugin-1-4-25-broken-access-control-vulnerability) and upgrade to the first release above 1.4.25 once published. Until a fix is confirmed, the most effective compensating controls are to deactivate the Royal MCP plugin if it is not essential (trade-off: loss of MCP functionality), and to disable open user registration (Settings > General > 'Anyone can register') so the PR:L precondition cannot be met by anonymous self-signup (trade-off: blocks legitimate self-service signups). Where the plugin must remain active, place its admin/AJAX/REST surface behind IP allow-listing or a WAF rule restricting access to the plugin's endpoints, and audit existing low-privilege accounts for anomalous activity (trade-off: WAF rules need tuning to avoid breaking legitimate plugin calls).