CVE-2026-19435

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content.

Score

CVSS 3.1 2.7 Low

Status

Deferred - contact@wpscan.com

Published

2026-08-21

Last modified

2026-10-18

Weaknesses

CWE-200

Affected products

• Duplicate Post (Unknown)

References

• https://wpscan.com/vulnerability/483051a0-28da-4141-a197-83bda56a29d4/