CVE-2026-111961

Royal MCP page cloning bypasses private-content and publishing permissions

Royal MCP maintainers · Royal MCP elementor_clone_page tool

First documented disclosure · Review checkpoint

Summary

Contributors can copy private or draft pages and publish without the required capability.

Severity and exploitation evidence

Low · 3.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources do not establish malicious exploitation or a confirmed victim incident.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A generic capability check substitutes for source-object read permission and permission to publish the copy.

Conditions required

An authenticated contributor-level user able to call the cloning tool.

Potential impact

Disclosure and unauthorized publication of private or draft page content.

Affected versions and configurations

Versions before 1.5.10.

Fix and mitigation status

1.5.10.

Practical next steps

Upgrade and restrict MCP connection and content-write permissions.

Operating lesson

Check source-read and destination-write authority independently.

Evidence and limits

WPScan published October 26; CNA ingestion followed October 28. WPScan assigns CVSS 3.1 3.8 using PR:H despite its contributor-level description; preserve the attributed score. Its PoC remains scheduled for November 9, not demonstrated exploitation.

Sources