Duplicate Post CVE-2026-19435

Exploitation requires an active authenticated WordPress session; the attacker must be a registered user on the target installation holding a delegated role that has access to the Duplicate Post plugin (such as contributor, editor, or a custom role). The Duplicate Post plugin must be installed and active on the target WordPress site. The CVSS PR:H assignment indicates a high-privilege authenticated context is required, though defenders should independently verify the minimum role threshold - if contributor-level access suffices, practical risk is higher than the 2.7 score implies. Exploitation is strictly limited to read-only information disclosure of post content, metadata, and passwords; no write, delete, or code execution capability is exposed. Single-author WordPress sites or installations without delegated roles face no realistic exposure.

The CVSS base score of 2.7 (Low) is driven by the high privilege requirement (PR:H) and limited confidentiality impact (C:L), with no integrity or availability impact. The AV:N/AC:L vector confirms network-accessible exploitation without special access complexity, but real-world risk is tightly scoped to multi-user WordPress installations where delegated editorial roles are provisioned - single-author or tightly-controlled sites have no practical exposure. A publicly available PoC lowers the technical barrier for any authenticated insider or compromised delegated account, but the absence of a CISA KEV listing means mass or opportunistic exploitation has not been confirmed at time of analysis. EPSS data was not provided in the source intelligence and cannot be assessed. The primary real-world concern is insider threat or privilege escalation via information leakage in agency, publishing, or multi-tenant WordPress environments. Note: the NVD-assigned PR:H may understate risk if the 'delegated role' threshold is closer to contributor-level (PR:L) - defenders should verify the minimum role required to trigger the flaw.

An attacker with a delegated WordPress role - such as a contributor on a multi-author editorial site - sends a crafted authenticated request to the Duplicate Post plugin's post-data endpoint targeting a private or draft post authored by another user. Because the plugin does not verify whether the requester has capability to read the target post, the server returns the full post content, metadata, and any post password. A publicly available PoC reduces the technical skill required, meaning any authenticated user aware of the vulnerability could enumerate restricted content.