High · 8.1 CVE-2026-54842 EUVD-2026-39387GHSA-7649-6hf2-rxrp

WordPress Royal MCP plugin <= 1.4.25 - Broken Access Control vulnerability

Published Jun 25, 2026 · Updated Jun 25, 2026 · Assigned by Patchstack

Description

Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Royal MCP: from n/a through 1.4.25.

Vendor	Product	Affected	Fixed
Royal Plugins	Royal MCP	≤ 1.4.25	—