Post Duplicator CVE-2026-111740

Requires an authenticated WordPress account on the target site with at least the Contributor role, and the vulnerable Post Duplicator plugin at a version before 3.0.17 installed and active. The exploit targets the plugin's post-type listing functionality, which returns a list of posts without checking whether the requesting user is permitted to view each post. Exploitation is limited by that authentication requirement (no anonymous/unauthenticated access) and by the narrow impact: only post titles and hierarchy of draft/private posts are exposed, not full post content, bodies, or write/modify capability. Sites with no untrusted Contributor-or-higher users, or already on 3.0.17+, are not exposed.

This is a genuinely low-priority issue, and the signals agree. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) scores only 2.7, reflecting a confidentiality-only impact limited to post titles and hierarchy. EPSS is 0.15% (4th percentile), SSVC reports Exploitation: none / Automatable: no / Technical Impact: partial, the CVE is not on CISA KEV, and the vuln.today decision label is 'monitor' - all consistent with a minor information-disclosure flaw rather than an urgent threat. One signal conflicts and should be noted: the input vector sets PR:H (high privileges), but the description states exploitation is possible 'with a role as low as Contributor,' which is a low-privilege authenticated role and maps to PR:L, not PR:H - verify with WPScan/vendor, as PR:H understates how easily a low-tier authenticated user can trigger it. A public PoC reference exists (WPScan) but is not verified as working exploit code, so it should not be read as active exploitation. Net: a real but minor privacy/confidentiality bug requiring an authenticated foothold; patch in the normal cycle.

An attacker who already holds a low-privilege Contributor account on a multi-author WordPress site invokes the plugin's post-listing request and receives titles and parent/child hierarchy of other users' draft and private posts they should not see. A public PoC reference exists (WPScan) but is not verified as working exploit code, and the leak is limited to metadata (titles and hierarchy), not full post content. Given AV:N/AC:L, the request is simple and remote once authenticated.