CVE-2026-10750 is a missing authorization vulnerability in the Royal MCP WordPress plugin prior to version 1.4.26. After token authentication, the plugin fails to perform capability checks on most of its MCP tools. This allows authenticated users with low privileges to bypass intended access controls, enabling them to read private content, enumerate all users and their roles, and manipulate content owned by other users. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality and integrity, with no impact on availability.

An attacker with a low-privileged authenticated account (e.g., Subscriber) can access private content, enumerate all users and their roles, and create, modify, or delete content owned by other users. This compromises confidentiality and integrity of the affected WordPress site content and user data. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch or official fix is released, restrict user roles and permissions carefully and monitor for suspicious activity related to content and user management within the Royal MCP plugin. Avoid granting unnecessary authenticated access to low-privileged users.