PLUGIN SECURITY
Is Royal Mcp safe?
Connect Claude, ChatGPT or any AI app to WordPress. Drafts only mode, access levels per app and a 72-hour undo. 300+ tools, self-hosted.
What this plugin does
- Slug:
royal-mcp - Author: Royal Plugins
- 10000+ active installs
- 100/100 rating (7 reviews on wordpress.org)
- 207176 all-time downloads
- On WordPress.org since 2026-01-14
AIChatGPTClaudeelementormcp
Maintenance status
- Latest known version: 1.4.39
- Last updated: 2026-11-11 11:01pm GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
6 known CVEs on file for Royal Mcp. Reported between 2026 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-111961 | Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP [royal-mcp] < 1.5.10 | Authorization Bypass Through User-Controlled Key | Unknown | < 1.5.10 | 1.5.10 | 2026-10-28 | ⚠ update needed |
| CVE-2026-111960 | Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP [royal-mcp] >= 1.4.38 - < 1.5.10 | Incorrect Authorization | Unknown | 1.4.38–1.5.10 | 1.5.10 | 2026-10-28 | ⚠ update needed |
| CVE-2026-111958 | Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP [royal-mcp] < 1.5.7 | Improper Authentication | Unknown | < 1.5.7 | 1.5.7 | 2026-10-22 | ⚠ update needed |
| CVE-2026-10750 | Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP [royal-mcp] < 1.4.26 | Missing Authorization | Unknown | < 1.4.26 | 1.4.26 | 2026-07-01 | ✓ fixed in latest |
| CVE-2026-54842 | Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP [royal-mcp] < 1.4.26 | Missing Authorization | High 8.1 | < 1.4.26 | 1.4.26 | 2026-06-18 | ✓ fixed in latest |
| CVE-2026-40775 | Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP [royal-mcp] < 1.4.3 | Missing Authorization | High 7.3 | < 1.4.3 | 1.4.3 | 2026-04-21 | ✓ fixed in latest |
How to fix it
Keep Royal Mcp updated — 1.4.39 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Elementor Website Builder – more than just a page builder — 10000000+ active installs — 90/100 (7325)
- Jetpack – AI Agents & MCP, Security, Backup & Analytics — 3000000+ active installs — 74/100 (2410)
- All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) — 2000000+ active installs — 94/100 (5235) — max PHP 8.4
- AI Agent by SiteGround — 1000000+ active installs — 34/100 (98) — max PHP <8.0
- Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates — 600000+ active installs — 98/100 (1680) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.