The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP WordPress plugin before 1.5.10.
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub