Threats tagged 'ghsa-5h77-wc4p-vj34'

1 threat

Threats tagged 'ghsa-5h77-wc4p-vj34'
Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	7.5	EPSS 0.2%	CVE-2026-111958Royal MCP · Improper Authentication High7.5EPSS 0.2%2026-10-22CVE Database V5CVE-2026-111958 The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the default configuration, across the entire REST API with no nonce, leading to full site takeover. EPSS 0.2%Vulnerability #cwe-287 #ghsa-5h77-wc4p-vj34	CVE Database V5	2026-10-22

Showing 1–1 of 1 result