royal_mcp vulnerabilities

CVEs whose affected-version data names the royal_mcp package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111958None

today

Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token

The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the defaul…

▾ Sunlitvia CVEORG