https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T01:30:12.288779+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-331540 EUVD-2026-331540 2026-10-15T01:30:12.291329+00:00 EUVD-2026-331540 https://cve.radiocsirt.org/vuln/fkie_cve-2026-10750 fkie_cve-2026-10750 2026-10-15T01:30:12.291359+00:00

The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenticated users with a low-privileged role such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.

 https://cve.radiocsirt.org/vuln/ghsa-mggr-4wrj-4f4g GHSA-mggr-4wrj-4f4g 2026-10-15T01:30:12.291389+00:00

The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenticated users with a low-privileged role such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.