EUVD-2026-63822
GHSA-mf7v-v9w5-f74c
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Exploitation requires authenticated access with a specifically delegated duplication role (PR:H); impact is bounded to reading one protected post's content (C:L), with no integrity or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable.
AnalysisAI
Duplicate Post WordPress plugin before 1.5.6 exposes password-protected post content to authenticated users who lack read authorization on those posts. The plugin's duplication feature fails to verify whether the requesting user has permission to read the source post, allowing any user with a delegated duplication role to republish another author's password-protected content as publicly readable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be an authenticated WordPress user with a role that has been explicitly delegated permission to use the Duplicate Post plugin's duplication feature. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 2.7 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N accurately reflects a genuinely low-severity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Duplicate Post plugin to version 1.5.6 or later, which introduces the missing authorization check before duplication is permitted. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Duplicate Post
View allThe "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. Rated high sever
Duplicate Post WordPress plugin before version 1.5.5 contains an IDOR flaw (CWE-639) in its bulk copy and delete operati
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plu
Unauthorized post data disclosure in the Duplicate Post WordPress plugin before 1.5.6 allows authenticated users holding
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capabili
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today