Yoast Duplicate Post EUVD-2026-36140

Exploitation requires that the target WordPress site has the Yoast Duplicate Post plugin installed and active in a version at or below 4.6. The victim must be any authenticated WordPress user - no elevated role or administrator privileges are required, as the handler performs no capability check. The attacker must be able to direct the authenticated victim to an attacker-controlled page (or inject a forged request via another vector such as an XSS on a third-party site). There is no requirement for the attacker to be authenticated. What limits exploitation is the mandatory active user interaction: the authenticated victim must visit the malicious page while their WordPress session is valid. The impact is confined to setting a single site option (notice suppression) and does not provide code execution, data exfiltration, or privilege escalation.

The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) accurately reflects the constrained real-world impact: the attack is network-reachable and requires no attacker privileges, but demands active user interaction (UI:A) from an authenticated victim, and the integrity impact is limited to a single site option (VI:L). No confidentiality or availability impact is present. The vulnerability is not in the CISA KEV catalog and no public proof-of-concept exploit code has been identified, making near-term mass exploitation unlikely. EPSS data was not provided; however, given the limited impact (notice suppression only) and the requirement for an authenticated victim, real-world exploitation risk is assessed as low to moderate - primarily relevant in targeted scenarios where an attacker wants to blind administrators to plugin update or security notices. The most significant threat model is an attacker who chains this with other techniques to prevent administrators from seeing alerts about a separate, more severe vulnerability or unauthorized change.

An attacker crafts a malicious web page containing an invisible HTML form or JavaScript fetch that submits a forged POST request to the target WordPress site's admin-ajax.php or equivalent endpoint with the duplicate_post_dismiss_notice action parameter set. The attacker then socially engineers any authenticated WordPress user - even a subscriber-level account - into visiting this page, perhaps via a phishing email or a comment link. The victim's browser automatically sends the request with their active session cookie, the handler processes it without validation, and the duplicate_post_show_notice option is set network-wide, suppressing plugin admin notices from that point forward.