Unknown Duplicate Post vulnerabilities
3 vulnerabilities
Known vulnerabilities in Unknown Duplicate Post, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2026-19435unknown · duplicate post +1 moreCopy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password DisclosureThe Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content.EPSS0.32%MediumCVE-2026-19077unknown · duplicate post +1 moreCopy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level AuthorizationThe Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users.EPSS0.42%MediumCVE-2026-19085unknown · duplicate post +1 moreCopy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content DisclosureThe Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable.EPSS0.30%