Yoast Duplicate Post EUVD-2026-12800

Despite the moderate CVSS 3.1 score (5.4), the real-world risk is elevated due to attack vector (Network/Unauthenticated access not required—only login needed), low attack complexity, and the sensitive nature of the impact. The vulnerability requires authenticated access (PR:L), which narrows the threat model to registered users, but WordPress sites commonly allow user registration. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates low confidentiality and integrity impact with no availability impact, but the ability to overwrite published content by Author-level attackers represents a significant integrity threat for multi-author sites. No EPSS or KEV status is explicitly provided in the intelligence, but Wordfence's active tracking and referenced source code links suggest this is a known, documented vulnerability with exploitation paths. Organizations with multi-author WordPress deployments should treat this as medium-to-high priority depending on their contributor pool.

An attacker with a Contributor account (commonly granted to freelance writers or guest bloggers) logs into a WordPress site and uses the Duplicate Post plugin's bulk action handler to clone a private product page or draft announcement intended for restricted release, then republishes the duplicate under a different URL, leaking confidential information. Alternatively, an Author-level attacker (e.g., a disgruntled employee) uses the Rewrite & Republish feature to overwrite the site's published homepage or critical post with malicious content, since the missing capability check allows them to modify posts beyond their own. The attack requires only valid WordPress credentials and HTTP POST requests via the WordPress admin interface (low complexity, no user interaction), making it straightforward to automate at scale across multiple posts.