CVE-2026-19435: Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure
Vulnerability summary
CVE-2026-19435 is a medium (CVSS 4.3) Missing Authorization vulnerability in unknown duplicate post. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.2% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.5.6.
Timeline
- 21-08-2026PublishedVulnerability first disclosed.
- 21-08-2026Last modifiedVulnerability information updated.
Description
The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NDiffers
- NVDNIST2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
Increase +0.12 pp
From 0.19% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Unknown1 product
- duplicate post< 1.5.6
Wordpress1 product
- copy-delete-posts< 1.5.6
2 vendors · 2 products