{"id":"CVE-2026-111960","aliases":[],"title":"Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability","titleSource":"WPScan","descriptionSource":"WPScan","products":[{"vendor":"Unknown","name":"Royal MCP","platforms":[],"versions":[{"version":"1.4.38","status":"affected","lessThan":"1.5.10","versionType":"semver"}],"defaultStatus":"unaffected","source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-111960"}],"remediation":[],"description":"The Royal MCP  WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP  WordPress plugin before 1.5.10.","severity":"unknown","score":null,"published":"2026-10-28T06:00:25.046Z","modified":"2026-10-28T06:00:25.046Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://wpscan.com/vulnerability/474153af-b440-4e89-a27b-131e94c4b63e/"],"sources":[{"name":"CVE","id":"CVE-2026-111960","modified":"2026-10-28T06:00:25.046Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-111960"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T15:50:37.681Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T10:35:33.924Z","attemptedAt":"2026-10-28T10:35:33.924Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-28T10:35:33.159Z","attemptedAt":"2026-10-28T10:35:33.159Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T10:35:33.159Z","attemptedAt":"2026-10-28T10:35:33.159Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T10:35:33.924Z","attemptedAt":"2026-10-28T10:35:33.924Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-334j-cwwv-qmmh","url":"https://github.com/advisories/GHSA-334j-cwwv-qmmh","modified":"2026-10-28T06:30:32Z","checkedAt":"2026-10-28T10:35:33.159Z"},{"source":"ENISA EUVD","id":"EUVD-2026-111720","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-111720","modified":"Oct 28, 2026, 6:00:25 AM","checkedAt":"2026-10-28T10:35:33.159Z"},{"source":"NVD","id":"CVE-2026-111960","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111960","modified":"2026-10-28T06:16:34.623","checkedAt":"2026-10-28T10:35:33.924Z"}]}