CVE-2026-111958: Royal MCP WordPress Auth Bypass Vulnerability

CVE-2026-111958 Overview

CVE-2026-111958 affects the Royal MCP WordPress plugin in versions prior to 1.5.7. The plugin issues preview-link tokens that are not scoped to the single preview they were generated for. Any party that obtains a valid token is authenticated as the token's owning user across the entire REST API, with no nonce verification required. In the default configuration the token owner is an administrator, so a leaked token grants full site takeover.

The vulnerability is categorized under [CWE-287] Improper Authentication.

Critical Impact
A single leaked preview token authenticates the attacker as an administrator across all REST API endpoints, enabling complete WordPress site compromise.

Affected Products

Royal MCP WordPress plugin versions prior to 1.5.7
WordPress sites with the plugin active in default configuration
Administrator accounts owning any issued preview-link token

Discovery Timeline

2026-10-22 - CVE-2026-111958 published to the National Vulnerability Database
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-111958

Vulnerability Analysis

The Royal MCP plugin generates preview-link tokens so authors can share drafts without logging reviewers in. The intended design binds each token to a single post preview. The plugin fails to enforce that binding and treats the token as a general session credential.

When the WordPress REST API receives a request carrying a valid preview token, the plugin resolves the token to its owning user and sets that user as the authenticated principal for the request. The REST authentication layer then skips the standard nonce check that normally protects authenticated API calls. An attacker holding a token can therefore invoke any REST route the owner is authorized to call.

In the default installation, preview tokens are issued to administrators. This maps directly to full site takeover, including plugin installation, user creation, and content modification through routes such as /wp-json/wp/v2/users and /wp-json/wp/v2/plugins.

Root Cause

The root cause is missing scope enforcement on the preview-link token. The authentication handler validates the token signature and ownership but does not restrict the token to the preview resource it was issued for. The handler also bypasses WordPress nonce verification once the token is accepted, removing a secondary control that would otherwise limit cross-endpoint abuse.

Attack Vector

The attack vector is network-based and requires the attacker to obtain a valid preview-link token. Tokens leak through shared preview URLs in email, chat logs, referrer headers, browser history, or server access logs. Once obtained, the attacker appends the token to any REST API request and executes administrator actions without credentials or nonces.

The vulnerability is described in prose only. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-111958

Indicators of Compromise

REST API requests to privileged routes such as /wp-json/wp/v2/users, /wp-json/wp/v2/plugins, or /wp-json/wp/v2/settings that carry a preview token query parameter.
Creation of new administrator accounts or installation of unknown plugins without a corresponding interactive admin login event.
Access logs showing a single preview token used against multiple distinct REST endpoints or post IDs.
Outbound requests from wp-content/plugins/ or wp-content/uploads/ to unknown hosts following REST API activity.

Detection Strategies

Parse web server access logs for query strings containing the plugin's preview token parameter and group by token value to surface tokens used against more than one resource.
Alert on REST API write methods (POST, PUT, DELETE) that authenticate via preview token rather than cookie or application password.
Compare administrator account inventory and active plugin list against a known-good baseline on a scheduled interval.

Monitoring Recommendations

Enable WordPress audit logging for user creation, role changes, plugin installation, and option updates.
Forward web server and WordPress audit logs to a centralized log platform for correlation with authentication events.
Monitor referrer and user-agent patterns for preview URLs appearing outside expected editorial workflows.

How to Mitigate CVE-2026-111958

Immediate Actions Required

Update the Royal MCP WordPress plugin to version 1.5.7 or later on every affected site.
Invalidate all existing preview-link tokens by rotating the plugin's signing secret or reinstalling the plugin.
Review the administrator user list and installed plugin inventory for unauthorized changes.
Rotate credentials for any administrator account that owned a shared preview token.

Patch Information

The vendor has released Royal MCP WordPress plugin version 1.5.7, which scopes preview tokens to their issued preview and restores nonce enforcement on REST API requests. Apply the patch through the WordPress plugin updater or by replacing the plugin directory with the fixed release.

Workarounds

Deactivate the Royal MCP plugin until the patched version can be deployed.
Restrict access to the WordPress REST API from untrusted networks using a web application firewall rule.
Block REST API requests that include the plugin's preview token parameter against write endpoints at the reverse proxy.
Downgrade the default token owner from administrator to a lower-privileged editor role where plugin configuration allows.

bash

# Configuration example: block preview-token REST writes at nginx
location ~ ^/wp-json/wp/v2/(users|plugins|settings) {
    if ($arg_preview_token) { return 403; }
    if ($request_method ~ ^(POST|PUT|DELETE)$) {
        # require authenticated session cookie
        if ($http_cookie !~ "wordpress_logged_in") { return 403; }
    }
}