Royal MCP EUVD-2026-111721

Requires an authenticated account with at least contributor-level privileges on a WordPress site running Royal MCP before 1.5.10, and the attacker must use the plugin's page-duplication feature against a target page by its identifier. Exploitation is limited to reading private/draft page content and publishing those pages - there is no availability impact and no code execution. Key limiting factors: a valid low-privilege authenticated session is mandatory (not anonymous), the vulnerable plugin must be installed and below 1.5.10, and impact is confined to page objects exposed through the duplication function.

This is a broken object-level authorization flaw (CWE-639) in the Royal MCP WordPress plugin that, by every real-world signal, is a low-to-moderate priority rather than an urgent threat. The supplied CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N, base 3.8) is internally inconsistent with the description: it specifies PR:H (high privileges), yet the description explicitly states the attacker only needs 'contributor-level access,' which is a low-privilege authenticated WordPress role - this points to PR:L, not PR:H, which would raise the base score to roughly 5.4. Verify the privilege metric with the vendor/WPScan advisory. EPSS is very low (0.15%, 4th percentile) and the vuln.today decision label is 'monitor,' both consistent with a low-urgency, low-automatability access-control bug that requires a pre-existing authenticated foothold. There is no CISA KEV listing and no SSVC exploitation data supplied, so there is no evidence of active exploitation; no public exploit identified at time of analysis (the references are advisories, not PoC/exploit code). Net: a legitimately-scoped authorization weakness with limited confidentiality and integrity impact, gated behind an authenticated contributor account - patch in normal cycles, not an emergency.

An attacker who already holds a contributor account (self-registered or compromised) on a site running Royal MCP before 1.5.10 invokes the plugin's page-duplication function against a private or draft page they should not be able to see. Because no object-level permission check is performed, they receive the full content of that private/draft page and can publish the duplicate without holding the publish capability. No public exploit identified at time of analysis.