Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · royal-mcp
royal-mcp
6 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 28, 2026Royal MCP: Does not perform an object-level permission check before duplicating a requested pageCVE-2026-111961 · fixed in 1.5.10 · reported by WPScanLow 3.8
The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capability.
Oct 28, 2026Royal MCP: Does not perform object-level or post-type authorisation checks in one of its search toolsCVE-2026-111960 · fixed in 1.5.10 · reported by WPScanMedium 4.3
The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP WordPress plugin before 1.5.10.
Oct 22, 2026Royal MCP: Does not limit a preview-link token to the single preview it was issued forCVE-2026-111958 · fixed in 1.5.7 · reported by WPScanHigh 7.5
The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce, leading to full site takeover.
Jul 1, 2026Royal MCP: Does not perform capability checks on the majority of its MCP tools after token authenticationCVE-2026-10750 · fixed in 1.4.26 · reported by WPScanHigh 8.1
The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenticated users with a low-privileged role such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.
Jun 25, 2026Royal MCP: Missing AuthorizationCVE-2026-54842 · affects up to 1.4.25 · reported by PatchstackHigh 8.1
Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25.
Jun 15, 2026Unauthenticated Broken Access Control in Royal MCP <= 1.4.2 versions.CVE-2026-40775 · affects up to 1.4.2 · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in Royal MCP <= 1.4.2 versions.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.