CVE-2026-111740
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type. This allows users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.
Risk Assessment
Disclosure of information about drafts and private posts can lead to leakage of confidential data or unintended disclosure of plans. This may compromise privacy and content security.
Recommendation
Update the Post Duplicator plugin to version 3.0.17 or later. Consider reviewing permissions for users with the Contributor role.
Other vulnerabilities in Post Duplicator WordPress plugin
Original NVD description (English source)
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS