{"id":"CVE-2026-111958","title":"Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token","summary":"The Royal MCP  WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the defaul…","severity":"none","cwe":["CWE-287"],"product":"Royal MCP","affected":["royal_mcp < 1.5.7"],"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T06:00:17.950Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111958","references":[{"url":"https://wpscan.com/vulnerability/014f061c-54f3-491e-b4a0-85cfa6fb178b/"}],"tags":["cve.org"],"ingestedAt":"2026-10-22T06:30:48.517Z","slug":"CVE-2026-111958","body":"## Overview\n\nThe Royal MCP  WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce, leading to full site takeover.\n\n## Affected\n\n- `royal_mcp < 1.5.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}