EUVD-2026-71850
GHSA-258v-5wmv-8454
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Contributor role is PR:L not PR:H; impact is strictly read-only access to private post content (C:L), with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata.
AnalysisAI
Unauthorized post-content disclosure in the Smart Post WordPress plugin before 4.0.8 allows any contributor-level authenticated user to duplicate any private or password-protected post into a personal draft, exposing the full content and metadata regardless of the original post's visibility or ownership restrictions. The flaw is rooted in the plugin's post-duplication feature entirely omitting checks on post type, status, and ownership before creating the copy. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account holding at least contributor-level privileges on the target site, and the Smart Post plugin must be installed and active in a version below 4.0.8. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector scores this at 2.7 with PR:H, but the description explicitly states exploitation requires only contributor-level access - a role that is conventionally PR:L in CVSS 3.1 terminology, suggesting the input vector underestimates accessibility; a corrected assessment yields approximately 4.3. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Smart Post plugin to version 4.0.8 or later, which introduces authorization checks on the duplication endpoint to validate post ownership, type, and visibility status before creating a copy. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Smart Post
View allShare
External POC / Exploit Code
Leaving vuln.today