The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenticated users with a low-privileged role such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Royal Mcp Plugin | — | Update royal-mcp plugin to version 1.4.26, or a newer patched version | Oct 30, 2026 | Jun 10, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub