CVE-2026-111960
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 28, 2026
Vendor
unknown
Description
The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP WordPress plugin before 1.5.10.