EUVD-2026-55000
GHSA-47f8-4hph-5246
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
PR:L rather than PR:H because the description allows any role granted plugin access, which typically includes low-privilege roles like Author or Editor.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users.
AnalysisAI
Duplicate Post WordPress plugin before version 1.5.5 contains an IDOR flaw (CWE-639) in its bulk copy and delete operations that enables authenticated users with plugin-level access to permanently delete arbitrary posts across the entire site, including content owned by other users. The missing per-object authorization check means that any WordPress user role an administrator has configured to use the plugin can bypass ownership boundaries and destroy content they did not create. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.13% (3rd percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis.
Technical ContextAI
The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), the classic IDOR pattern: WordPress plugins performing bulk operations on posts must enforce two distinct checks - whether the user has capability to use the feature, and whether the user has rights to each specific post object being acted upon. The Duplicate Post plugin applies role-level capability checks but omits per-object ownership validation, allowing a user-controlled post ID parameter in bulk copy and delete requests to reference posts beyond the user's legitimate scope. The affected product is identified by CPE cpe:2.3:a:unknown:duplicate_post:*:*:*:*:*:*:*:*, covering all releases from 0 up to but not including 1.5.5. The WordPress REST or admin-ajax surface used for these bulk operations processes the object key without re-verifying authorship or edit permissions against the requesting user.
RemediationAI
Update the Duplicate Post WordPress plugin to version 1.5.5 or later, which contains the vendor-released fix per the CVE description and EUVD-2026-55000; consult the WPScan advisory at https://wpscan.com/vulnerability/dcced434-f7c0-4e19-b3cb-8196f6636aa3/ for confirmation. If immediate upgrade is not possible, administrators should navigate to the plugin's role-access settings and remove plugin access from any non-administrator roles until patching is complete - the trade-off being that those users will lose the ability to duplicate posts during the interim period. Additionally, ensure site backups are current and tested, since post deletion via this flaw is permanent without a restore point. No network-layer control is effective as a workaround because the requests originate from authenticated sessions over standard WordPress admin channels.
More in Duplicate Post
View allThe "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. Rated high sever
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plu
Unauthorized post data disclosure in the Duplicate Post WordPress plugin before 1.5.6 allows authenticated users holding
Duplicate Post WordPress plugin before 1.5.6 exposes password-protected post content to authenticated users who lack rea
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capabili
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today