Royal MCP: a preview link token signs the holder in as the site admin
Royal MCP preview tokens were not bound to a single preview, so holding one grants its owner's full REST API access.
· WPScan · Research by Raphael P. Cigana
Royal MCP, a WordPress plugin that lets Claude and ChatGPT drive a site over MCP, did not tie a preview link token to one preview. Anyone holding a valid token is authenticated as its owner, which is an administrator by default.
01What happened
WPScan published CVE-2026-111958 against the Royal MCP WordPress plugin on 20 October 2026 and credits Raphael P. Cigana with the finding. Versions below 1.5.7 are affected. WPScan is withholding the proof of concept until 20 November 2026.
02How it works
The plugin issues a token alongside a preview link but does not limit that token to the single preview it was created for. A holder of a valid token is logged in as the token's owner across the whole REST API, and no nonce is required. Because that owner is an administrator by default, the bypass reaches every administrative REST route and can give an attacker complete control of the site.
03Who is affected
Royal MCP installations below 1.5.7 are exposed, and the plugin directory lists more than 10,000 active installations. Sites that share preview links outside the editing team carry the most risk, because the token travels with the link.
04What to do
Update Royal MCP to 1.5.7 or later; the current release is 1.5.11. After updating, revoke connected AI clients from the plugin's Connected Clients screen and rotate the API key with the plugin's WP-CLI command.
Sources 2 links, all fetched
- 1wpscan.comWPScan Advisory
- 2wordpress.orgPlugin Directory