Royal MCP Plugin Insufficient Capability Checks Post-Authentication

The Royal MCP WordPress plugin before version 1.4.26 contains a privilege escalation vulnerability where authenticated users bypass capability checks on MCP tool endpoints after token authentication succeeds. This allows low-privileged users (such as Subscribers) to perform administrative actions including reading private content, enumerating user accounts and roles, and creating, modifying, or deleting content they should not access. WordPress sites using this plugin with multiple user roles are at risk, as the vulnerability fundamentally breaks the role-based access control (RBAC) model that underpins WordPress security.

While this CVE lacks explicit MITRE ATT&CK mapping, practitioners using Casky.ai would detect the underlying attack patterns through skill evaluation of Privilege Escalation (T1134) and Unauthorized Access behaviors. Claude's extended reasoning would identify the core weakness: token validation occurring without subsequent capability verification on protected endpoints. Security teams would observe findings showing authenticated but unprivileged API requests succeeding when they should fail, improper user enumeration despite role restrictions, and unauthorized content modification attempts originating from low-privilege session contexts. The absence of matching Casky skills (0) indicates this plugin-specific implementation gap would require custom detection logic mapping token-authenticated requests to WordPress capability checks (edit_posts, read_private_posts, manage_users) to surface the violation of least-privilege principles.