Royal MCP CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Royal MCP CVE published 2026-10-22

CVE-2026-111958

The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, allowing any party with a valid token to be authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce, leading to full site takeover. This vulnerability emphasizes the need for defenders to verify and remediate the [truncated]