What is the CVSS score of EUVD-2026-12800?

EUVD-2026-12800 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Yoast Duplicate Post are affected by EUVD-2026-12800?

Organizations using all should be aware of moderate risk from CVE-2026-1217, a missing authorization vulnerability rated CVSS 5.4. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate EUVD-2026-12800?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Yoast Duplicate Post EUVD-2026-12800

| CVE-2026-1217 MEDIUM

Missing Authorization (CWE-862)

2026-03-18 Wordfence

GHSA-g9w4-m5fx-x3wv

WordPress Authentication Bypass Yoast Duplicate Post Wordpress Plugin Yoast

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 18, 2026 - 09:45 euvd

EUVD-2026-12800

Analysis Generated

Mar 18, 2026 - 09:45 vuln.today

CVE Published

Mar 18, 2026 - 09:28 nvd

MEDIUM 5.4

DescriptionCVE.org

The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_handler() and republish_request() functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate any post on the site including private, draft, and trashed posts they shouldn't have access to. Additionally, attackers with Author-level access and above can use the Rewrite & Republish feature to overwrite any published post with their own content.

AnalysisAI

The Yoast Duplicate Post WordPress plugin through version 4.5 contains a missing capability check vulnerability in the clone_bulk_action_handler() and republish_request() functions, allowing authenticated attackers with Contributor-level access to duplicate restricted posts (private, draft, trashed) and Author-level attackers to overwrite published posts via the Rewrite & Republish feature. The vulnerability carries a CVSS score of 5.4 (medium severity) with ENISA EUVD tracking (EUVD-2026-12800), and Wordfence has documented specific vulnerable code paths in the plugin's bulk handler and post republisher modules.

Technical ContextAI

The vulnerability exists in WordPress plugin code (cpe:2.3:a:yoast:yoast_duplicate_post:*:*:*:*:*:*:*:*) and falls under CWE-862 (Missing Authorization / Capability Check). The affected functions—clone_bulk_action_handler() in bulk-handler.php (line 115) and republish_request() in post-republisher.php (line 128)—fail to verify user capabilities before allowing post duplication and republishing actions. WordPress uses capability-based access control (via functions like current_user_can()), and the absence of such checks allows privilege escalation where lower-privileged authenticated users bypass content ownership and publication status restrictions. This is a PHP/WordPress-specific authorization flaw.

RemediationAI

Upgrade the Yoast Duplicate Post plugin to version 4.6 or later, which contains the capability check fixes. Access the plugin update mechanism via WordPress Dashboard (Plugins > Installed Plugins) or download the patched version from https://plugins.wordpress.org/duplicate-post/. Until patching is possible, implement immediate mitigations: (1) restrict user registrations to trusted administrators only via WordPress Settings > General or remove open registration; (2) audit user roles and demote any unnecessary Contributor or Author accounts; (3) enable WordPress post revision history and backup the database to detect unauthorized post modifications; (4) use WordPress security plugins (Wordfence, Sucuri) to monitor bulk actions and post republish events. For multi-author sites requiring Contributor access, consider disabling the Duplicate Post and Rewrite & Republish features via code until the patch is applied.