CVE-2026-19085
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable.
Risk Assessment
A user with a delegated role can publicly expose password-protected content, compromising confidentiality and access control.
Recommendation
Update the Duplicate Post plugin to version 1.5.6 or later.
Other vulnerabilities in Duplicate Post WordPress plugin
Original NVD description (English source)
The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS