{"id":"CVE-2026-111958","title":"Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token","summary":"The Royal MCP  WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the defaul…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"adp","cwe":["CWE-287"],"product":"Royal MCP","affected":["royal_mcp < 1.5.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-22T10:56:11.078787Z"},"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T11:06:29.135Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111958","references":[{"url":"https://wpscan.com/vulnerability/014f061c-54f3-491e-b4a0-85cfa6fb178b/"}],"tags":["cve.org"],"ingestedAt":"2026-10-22T06:30:48.517Z","epss":0.00248,"epssPercentile":0.15993,"slug":"CVE-2026-111958","body":"## Overview\n\nThe Royal MCP  WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce, leading to full site takeover.\n\n## Affected\n\n- `royal_mcp < 1.5.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":227590,"id":"CVE-2026-111958","ts":1792669056464,"field":"cvss","old":null,"new":"7.5"},{"seq":227589,"id":"CVE-2026-111958","ts":1792669056464,"field":"severity","old":"none","new":"high"}]}