{"id":"CVE-2026-111961","title":"Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page","summary":"The Royal MCP  WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full conte…","severity":"low","cvss":3.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","cvssSource":"adp","cwe":["CWE-639"],"product":"Royal MCP","affected":["royal_mcp < 1.5.10"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-28T17:43:16.163601Z"},"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T17:58:05.821Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111961","references":[{"url":"https://wpscan.com/vulnerability/ffdf84e4-dce3-4768-91c9-138256c3064c/"}],"tags":["cve.org"],"epss":0.00148,"epssPercentile":0.04014,"ingestedAt":"2026-10-28T07:06:27.145Z","slug":"CVE-2026-111961","body":"## Overview\n\nThe Royal MCP  WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capability.\n\n## Affected\n\n- `royal_mcp < 1.5.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":21,"depthScoreParts":{"impact":20.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":230817,"id":"CVE-2026-111961","ts":1793211386046,"field":"cvss","old":null,"new":"3.8"},{"seq":230816,"id":"CVE-2026-111961","ts":1793211386046,"field":"severity","old":"none","new":"low"}]}