CVE-2026-19435
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content.
Risk Assessment
Users with a delegated role can access sensitive content and passwords of other users, compromising data confidentiality.
Recommendation
Update the Duplicate Post plugin to version 1.5.6 or later.
Other vulnerabilities in Duplicate Post WordPress plugin
Original NVD description (English source)
The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content.