EUVD-2026-36139
GHSA-cx2j-wv5h-5j6v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege WordPress account
-
DeliveryConfirm cdp_action_handling reachable via admin-ajax.php
-
ExploitPOST action=cdp_action_handling with malicious f value
-
ExecutionDispatcher skips per-function capability check
-
PersistDelete posts or overwrite plugin settings
-
ImpactLeverage altered settings for further site impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) the Copy & Delete Posts plugin installed at version ≤1.5.4 on a WordPress site, (2) an authenticated session for a WordPress user whose role has been explicitly added to the plugin's enabled-roles configuration (any non-admin role suffices - Editor, Author, Contributor, or even Subscriber if the operator enabled it), and (3) the ability to reach /wp-admin/admin-ajax.php over the network. Limiting factors: sites that leave the plugin's role list at admin-only are not exploitable by non-admins, the attacker must hold valid credentials (PR:L, not PR:N), and no user interaction by an admin is required. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, VI:H/VA:H, VC:N) accurately captures the situation: remote, low-complexity, requires one low-privilege session, and damages integrity and availability of site content/configuration but not confidentiality. Realistic priority is moderate-to-high for any site that delegates editorial roles (Editor, Author, Contributor, Subscriber-with-plugin-cap) to untrusted users, because privilege escalation to destructive admin-equivalent actions on this plugin's scope is one HTTP request away. There is no KEV listing and no EPSS value supplied, and no POC is referenced - so widespread opportunistic exploitation is not currently evidenced, but the bug class is trivially weaponizable once a researcher publishes the f parameter values. Note that the input provides only CVSS 4.0; the CVSS 3.1 equivalent would also be in the High range, and the absence of EPSS/KEV data should not be read as 'low risk' - it is missing data, not a clean signal. |
| Exploit ScenarioDerived | An attacker registers or compromises a low-privilege WordPress account (for example a Contributor or a Subscriber on a site that has granted that role to the plugin), authenticates, and sends a POST to /wp-admin/admin-ajax.php with action=cdp_action_handling and an f parameter selecting the delete-posts or update-settings branch. Because the dispatcher only verifies the coarse role gate and skips the per-function capability check, the request succeeds and the attacker mass-deletes published posts or rewrites plugin settings to pivot further. No public POC is referenced in the supplied data, but the AJAX handler name and f-parameter pattern are documented enough that a working request is straightforward to reconstruct. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 10, 2026
Broken authorization in the Copy & Delete Posts WordPress plugin through 1.5.4 lets any authenticated user assigned a plugin-enabled (non-admin) role invoke every operation exposed by the cdp_action_handling AJAX endpoint, enabling post deletion and plugin-setting tampering. The flaw stems from a missing per-function capability check that the dispatcher should enforce based on the f parameter. No public exploit identified at time of analysis and the CVE is not on CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis - neither the WordPress.org plugin page nor the VulnCheck advisory in the supplied references names a fixed version beyond 1.5.4, so administrators should monitor https://wordpress.org/plugins/copy-delete-posts/ for an update past 1.5.4 and the VulnCheck advisory at https://www.vulncheck.com/advisories/copy-delete-posts-through-privilege-escalation-via-cdp-action-handling-handler for confirmation. Until a fixed release is published, the highest-leverage compensating control is to restrict the plugin's enabled-role list to administrators only via the plugin's own settings, which removes the abusable PR:L path at the cost of losing delegated copy/delete workflows for editors. As a network-layer mitigation, block or require admin authentication on POST requests to /wp-admin/admin-ajax.php where action=cdp_action_handling using a WAF rule, accepting that this will break the plugin's UI for any non-admin role; a stricter fallback is to deactivate the plugin entirely, which fully removes the vulnerability but disables all bulk copy/delete functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Copy & Delete Posts is a WordPress plugin (vendor inisev, CPE inisev:copy_&_delete_posts) that adds bulk post-management actions and exposes a server-side dispatcher named cdp_action_handling via the WordPress admin-ajax interface. The dispatcher reads an f parameter to select which internal handler to run (delete posts, overwrite plugin settings, etc.), but enforces only a coarse 'is the caller a plugin-enabled role' gate at the entry point instead of re-checking the WordPress capability appropriate to each sub-action. This is a textbook CWE-863 (Incorrect Authorization) pattern: the trust decision is made once at the wrapper, so the more sensitive branches inherit the weakest required privilege.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable admin-ajax endpoint, no user interaction, requires a low-privilege authenticated role (PR:L), and yields high integrity/availability impact via post deletion and settings overwrite with no confidentiality disclosure.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler. Attackers with an enabled role can delete posts or overwrite plugin settings via the f parameter, bypassing per-function capability checks.
Executive ViewAI
The Copy & Delete Posts WordPress plugin (version 1.5.4 and earlier) contains a broken authorization vulnerability (CVSS 7.2) allowing authenticated users with plugin-enabled roles to delete posts and modify plugin settings. No public exploit identified at time of analysis. This threatens post integrity and operational continuity for WordPress sites relying on this plugin.
Restrict plugin-enabled role assignments to administrative-level personnel only; disable the plugin if not actively required; implement comprehensive audit logging for post deletion and plugin setting changes; monitor for unauthorized access patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB