CVE-2026-53739
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A Cross-Site Request Forgery (CSRF) vulnerability was found in the Yoast Duplicate Post plugin up to version 4.6 in the duplicate_post_dismiss_notice handler. Lack of nonce or capability verification allows an attacker to trick an authenticated user into sending a request that sets the duplicate_post_show_notice option, suppressing admin notices network-wide.
Risk Assessment
An attacker can hide important admin notices, potentially delaying response to other threats or issues in the WordPress system.
Recommendation
It is recommended to update the Yoast Duplicate Post plugin to version 4.7 or later, which contains a fix for the CSRF vulnerability.
Other vulnerabilities in Yoast Duplicate Post
Original NVD description (English source)
Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notice handler, which verifies no nonce or capability. Attackers can trick any authenticated user into sending a request that sets the duplicate_post_show_notice site option, suppressing admin notices network-wide.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS