CVE-2026-10750

HighCVSS 8.1/10Last modified Jul 1, 2026

Description

The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenticated users with a low-privileged role such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jul 1, 2026
Last modified: Jul 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1075037.1In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including CVE-2026-1075067.5The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allo CVE-2026-1075072.7The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lo CVE-2026-1075088.6The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing un CVE-2026-1075096.5A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a single SQL Expression query that c CVE-2026-107517.5IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deseria CVE-2026-1075109.1An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.CVE-2026-107524.8The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.CVE-2026-107532.7The Site Kit by Google WordPress plugin before 1.176.0 does not properly restrict a REST API write endpoint to administrators, allowing low CVE-2026-107548.6Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to CVE-2026-107552.7The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allow CVE-2026-107567.7TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to