The vulnerability is a missing authorization flaw that permits users with incorrect or low access levels to perform actions reserved for higher‑privileged accounts. This broken access control can expose administrative interfaces, sensitive configuration data, and business logic controls. An attacker who can exercise these privileges may alter plugin settings, hijack user roles, or gain further system compromise.

All installations of the WordPress Royal MCP plugin released up to and including version 1.4.25 are affected. The issue resides within Royal Plugins' Royal MCP component, which is installed on WordPress sites via the plugin marketplace or manual upload.

The CVSS score of 8.1 indicates a high‑severity flaw. While the EPSS score is currently not available, the lack of KEV listing suggests that the vulnerability is not yet widely exploited, yet the high score warrants caution. Based on the description, the likely attack vector is through the plugin's administrative controls or API endpoints that do not properly enforce role verification, allowing an attacker who can access these endpoints to elevate privileges or access sensitive information.