EUVD-2026-63823
GHSA-j65v-fgx5-j923
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Delegated WordPress roles (contributor/editor) are low-privilege authenticated accounts, making PR:L more accurate than the NVD-assigned PR:H; C:L reflects read-only post disclosure with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content.
AnalysisAI
Unauthorized post data disclosure in the Duplicate Post WordPress plugin before 1.5.6 allows authenticated users holding a delegated role to read content, metadata, and passwords for posts they should not have access to - including other users' private and draft posts. The CVSS vector (PR:H/C:L) reflects a constrained impact limited to information disclosure within authenticated contexts, making this a meaningful risk in multi-user editorial WordPress environments but not in single-author deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active authenticated WordPress session; the attacker must be a registered user on the target installation holding a delegated role that has access to the Duplicate Post plugin (such as contributor, editor, or a custom role). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 2.7 (Low) is driven by the high privilege requirement (PR:H) and limited confidentiality impact (C:L), with no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Duplicate Post WordPress plugin to version 1.5.6 or later, which introduces the missing capability check and resolves the unauthorized data exposure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Duplicate Post
View allThe "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. Rated high sever
Duplicate Post WordPress plugin before version 1.5.5 contains an IDOR flaw (CWE-639) in its bulk copy and delete operati
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plu
Duplicate Post WordPress plugin before 1.5.6 exposes password-protected post content to authenticated users who lack rea
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capabili
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today