What is the CVSS score of CVE-2026-1217?

CVE-2026-1217 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1217?

Organizations using all should be aware of moderate risk from CVE-2026-1217, a missing authorization vulnerability rated CVSS 5.4. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate CVE-2026-1217?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-1217

EUVD-2026-12800 MEDIUM

Missing Authorization (CWE-862)

2026-03-18 Wordfence

GHSA-g9w4-m5fx-x3wv

WordPress Authentication Bypass

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 18, 2026 - 09:45 euvd

EUVD-2026-12800

Analysis Generated

Mar 18, 2026 - 09:45 vuln.today

CVE Published

Mar 18, 2026 - 09:28 nvd

MEDIUM 5.4

DescriptionCVE.org

The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_handler() and republish_request() functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate any post on the site including private, draft, and trashed posts they shouldn't have access to. Additionally, attackers with Author-level access and above can use the Rewrite & Republish feature to overwrite any published post with their own content.

AnalysisAI

The Yoast Duplicate Post WordPress plugin through version 4.5 contains a missing capability check vulnerability in the clone_bulk_action_handler() and republish_request() functions, allowing authenticated attackers with Contributor-level access to duplicate restricted posts (private, draft, trashed) and Author-level attackers to overwrite published posts via the Rewrite & Republish feature. The vulnerability carries a CVSS score of 5.4 (medium severity) with ENISA EUVD tracking (EUVD-2026-12800), and Wordfence has documented specific vulnerable code paths in the plugin's bulk handler and post republisher modules.

Technical ContextAI

The vulnerability exists in WordPress plugin code (cpe:2.3:a:yoast:yoast_duplicate_post:*:*:*:*:*:*:*:*) and falls under CWE-862 (Missing Authorization / Capability Check). The affected functions—clone_bulk_action_handler() in bulk-handler.php (line 115) and republish_request() in post-republisher.php (line 128)—fail to verify user capabilities before allowing post duplication and republishing actions. WordPress uses capability-based access control (via functions like current_user_can()), and the absence of such checks allows privilege escalation where lower-privileged authenticated users bypass content ownership and publication status restrictions. This is a PHP/WordPress-specific authorization flaw.

RemediationAI

Upgrade the Yoast Duplicate Post plugin to version 4.6 or later, which contains the capability check fixes. Access the plugin update mechanism via WordPress Dashboard (Plugins > Installed Plugins) or download the patched version from https://plugins.wordpress.org/duplicate-post/. Until patching is possible, implement immediate mitigations: (1) restrict user registrations to trusted administrators only via WordPress Settings > General or remove open registration; (2) audit user roles and demote any unnecessary Contributor or Author accounts; (3) enable WordPress post revision history and backup the database to detect unauthorized post modifications; (4) use WordPress security plugins (Wordfence, Sucuri) to monitor bulk actions and post republish events. For multi-author sites requiring Contributor access, consider disabling the Duplicate Post and Rewrite & Republish features via code until the patch is applied.