Description

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-21T07:16:25.243Z",
  "pubdate": "2026-08-21T07:16:25.243Z",
  "executiveSummary": "The Duplicate Post WordPress plugin before 1.5.6 suffers from an authorization bypass vulnerability affecting access control enforcement during content duplication.\nThe flaw allows authenticated users assigned to delegated roles—who lack permissions to directly read or access the underlying content—to successfully duplicate restricted posts.\nSpecifically, an attacker can leverage this functionality to target password-protected posts belonging to other users and republish them as publicly readable content.\nThis leads to an unauthorized information disclosure and loss of content confidentiality, bypassing the native access restrictions enforced by the WordPress core content management system.\nThe vulnerability requires authenticated access with a delegated user role capable of interacting with the plugin's functionality, but does not necessitate direct read access to the targeted source post prior to exploitation.",
  "technicalDetails": "The root cause of the vulnerability lies in inadequate access control validation within the Duplicate Post WordPress plugin prior to version 1.5.6.\nWhen processing a duplication request, the vulnerable component fails to verify whether the initiating user possesses sufficient read permissions or authorization to access the original post's content before creating a new database entry.\nIn standard WordPress architecture, password-protected posts require the supplying of a valid session cookie or password to view the protected body text.\nHowever, the plugin executes the duplication logic without asserting these constraints, bypassing the intended authorization checks.\nThe attack flow proceeds as follows: an authenticated user with a delegated role navigates to the administrative interface or triggers the duplication action against a restricted target post (such as a password-protected post authored by another user).\nUpon receiving the request, the plugin reads the restricted post data from the database and instantiates a new draft or published post containing the sensitive content.\nBecause the newly generated post does not retain the original password protection settings by default, the duplicated copy becomes publicly readable upon publication.\nThe affected versions include all instances of the Duplicate Post WordPress plugin prior to 1.5.6.\nExploitation requires authenticated access with delegated privileges and network exposure to the WordPress administrative backend, resulting in complete compromise of confidentiality for targeted restricted posts."
}