WordPress Plugin Vulnerabilities

Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page

Description

The plugin does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capability.

Proof of Concept

Affects Plugins

Plugin icon
royal-mcp
Fixed in 1.5.10

References

CVE
CVE-2026-111961

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
3.8 (low)

Miscellaneous

Original Researcher
Usama Arshad
Submitter
Usama Arshad
Submitter website
https://www.usamaarshad.me/
Submitter twitter
usama0x01
Verified
Yes
WPVDB ID
ffdf84e4-dce3-4768-91c9-138256c3064c

Timeline

Publicly Published
2026-10-26 (about 2 days ago)
Added
2026-10-26 (about 1 day ago)
Last Updated
2026-10-26 (about 1 day ago)

Other

Published
Title
Published
2025-05-13
Title
PeepSo Core: File Uploads < 6.4.6.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via file_download
Published
2025-12-20
Title
WP JobHunt <= 7.7 - Authenticated (Candidate+) Insecure Direct Object Reference
Published
2026-09-17
Title
LatePoint < 5.6.4 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)
Published
2026-09-17
Title
Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOR
Published
2026-09-17
Title
Download Manager < 3.3.69 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter