Description

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-21T07:16:25.340Z",
  "pubdate": "2026-08-21T07:16:25.340Z",
  "executiveSummary": "The Duplicate Post WordPress plugin before 1.5.6 suffers from an authorization bypass vulnerability affecting access control enforcement.\nThe vulnerability allows authenticated users with delegated roles to improperly access sensitive post data, including post content, metadata, and passwords, that they lack permissions to view.\nThe affected product is the Duplicate Post WordPress plugin in versions prior to 1.5.6.\nThe risk implications include unauthorized information disclosure of private and draft content belonging to other users within the WordPress installation.\nAn attacker must possess a delegated user role on the target WordPress site to successfully leverage this capability.\nNo complex exploitation requirements are specified beyond having standard authenticated access with a lower-privileged or delegated role.",
  "technicalDetails": "The root cause of the vulnerability resides in the application logic of the Duplicate Post WordPress plugin where proper permission checks and capability validations are omitted prior to returning post data.\nSpecifically, the vulnerable component fails to enforce access control lists (ACLs) or verify whether the requesting user possesses the necessary WordPress capabilities (such as edit_private_posts or edit_others_posts) before executing post data retrieval routines.\nExploitation occurs when an authenticated user with a delegated role interacts with the plugin functionality designed to clone or retrieve post information.\nBecause the underlying request lacks proper authorization validation, the plugin processes the query and returns the requested post data indiscriminately.\nThe attack flow proceeds as follows: First, an authenticated attacker with a delegated role identifies the target post identifier (ID) or triggers the duplicate functionality targeting specific restricted posts, including drafts and private entries. Second, the plugin queries the WordPress database for the specified post records without validating the user's capability context. Third, the application serializes and returns the complete post object, which includes sensitive attributes such as post content, metadata, and passwords. Finally, the attacker ingests the unauthorized data, resulting in a confidentiality breach.\nThe affected versions include all releases of the Duplicate Post WordPress plugin prior to version 1.5.6.\nThe vulnerability requires local network exposure to the WordPress administrative or front-end interface, valid authentication credentials, and a delegated user role assigned within the target WordPress environment.\nPost-exploitation impact is characterized by unauthorized data exfiltration, specifically the exposure of intellectual property, sensitive draft information, private user communications, and post-level passwords stored within the database."
}