Threat database

CVE-2026-42696 is a critical vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning that allows remote code inclusion due to improper control of code generation. This vulnerability affects versions from the initial release up to 1.5.19. It has a maximum CVSS score of 10.0, indicating it can be exploited remotely without privileges or user interaction, potentially leading to full system compromise.

Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration &amp; Cloning <= 1.5.17 versions.

Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25.

CVE-2026-40775 is a high-severity vulnerability in Royal Plugins' Royal MCP product affecting versions up to and including 1.4.2. It involves unauthenticated broken access control, classified under CWE-862, allowing unauthorized users to bypass authorization checks. The vulnerability has a CVSS 3.1 base score of 7.3, indicating a significant risk with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.