Duplicate Post CVE-2026-19085

Exploitation requires the attacker to be an authenticated WordPress user with a role that has been explicitly delegated permission to use the Duplicate Post plugin's duplication feature. The target WordPress installation must be running Duplicate Post version prior to 1.5.6 and must have at least one password-protected post authored by a different user. Unauthenticated users cannot exploit this vulnerability. The high privilege requirement (PR:H per CVSS) limits exposure to trusted-but-delegated internal actors or compromised accounts holding duplication-capable roles. Non-default plugin configuration granting duplication rights to lower-trust roles would increase exposure.

The CVSS 3.1 score of 2.7 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N accurately reflects a genuinely low-severity issue. PR:H constrains exploitation to authenticated users with a specifically delegated role, substantially limiting the attack surface. The confidentiality impact (C:L) is bounded to discrete post content rather than systemic data exposure. No EPSS data was provided in the input, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation. Despite a publicly available proof-of-concept reported by WPScan, the high privilege requirement and narrow impact scope make this a low real-world priority for most organizations. The primary risk is insider threat or compromised delegated accounts on multi-author WordPress installations.

An authenticated WordPress contributor or editor who has been granted access to the Duplicate Post feature navigates to a password-protected post authored by another user, triggers the plugin's duplication action using the target post's ID, and the cloned post is saved without password protection, making the full content publicly accessible to any site visitor. A publicly available proof-of-concept demonstrates this workflow.