CVE-2026-19077
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Duplicate Post plugin before version 1.5.5 does not perform per-object authorization checks in its bulk copy and delete operations. This allows any user whose role an administrator has granted access to the plugin to permanently delete arbitrary posts on the site, including those belonging to other users.
Risk Assessment
A user with limited privileges can delete critical content, leading to data loss and disruption of the site.
Recommendation
Update the plugin to version 1.5.5 or later and review the permissions of users with access to bulk operations.
Original NVD description (English source)
The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users.