Duplicate Post CVE-2026-19077

Exploitation requires two conditions: (1) the target WordPress site must have the Duplicate Post plugin installed and active in a version before 1.5.5, and (2) the attacker must be an authenticated WordPress user whose role has been explicitly granted plugin access by an administrator via the plugin's role-access configuration settings. Sites where only the Administrator role has plugin access are not exploitable by lower-privilege users. Sites with no backups face irreversible content loss. Exploitation is limited by the requirement for authenticated contributor-level access - unauthenticated attackers and users on sites where the plugin is restricted to admins only are not affected. There is no user interaction or social engineering component once plugin access is established.

The official CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H assigns PR:H (High Privileges), which may understate real-world risk. The description states the flaw is exploitable by 'any user whose role an administrator has granted plugin access,' which in practice often includes Author and Editor roles - mapping to PR:L in CVSS terms, not PR:H. At PR:L, the base score would rise to approximately 8.1. EPSS at 0.13% (3rd percentile) is low and consistent with the absence from CISA KEV, suggesting no opportunistic or widespread exploitation campaigns have been observed. However, a public POC is confirmed by WPScan, which lowers the skill barrier for exploitation. The non-reversible nature of permanent post deletion (without backups) amplifies the practical impact on multi-author WordPress sites. Risk is highest on sites with multiple contributor/author-level users who have been granted plugin access, and lowest on single-author sites or installations where only administrators use the plugin. The CVSS confidentiality impact (C:N) is correctly assessed - this is a destruction/integrity attack with no data exfiltration component.

An authenticated WordPress user with Author-level access on a multi-contributor news or blog site - whose role the administrator has configured to use the Duplicate Post plugin - crafts bulk delete requests substituting post IDs belonging to editors or administrators. Leveraging the publicly available POC documented by WPScan, the attacker iterates through post IDs, permanently deleting arbitrary published content across the site before the action is detected. Without a recent backup, content is unrecoverable.