{"id":"CVE-2026-111961","published":"2026-10-28T06:16:34.737","lastModified":"2026-10-28T06:16:34.737","description":"The Royal MCP  WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capability.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/ffdf84e4-dce3-4768-91c9-138256c3064c/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}