{
 "id": "WPSEC-2026-1080",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1080/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1080/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1080/index.md",
 "title": "Nexter Extension <= 4.7.12 - Authenticated (Contributor+) Missing Authorization to Post Publication via Post Duplicator",
 "description": "The Nexter Extension plugin for WordPress is vulnerable to unauthorized post publication via the Post Duplicator feature in all versions up to, and including, 4.7.12. This is due to the nxt_duplicate_post AJAX action giving the copy the status set in the duplicator settings ('publish', 'future' or 'private') without checking that the current user has the publish_posts capability for that post type. This makes it possible for authenticated attackers with Contributor-level access and above to publish content without review by duplicating a post they can edit, when the duplicator is set to give copies a published, scheduled or private status.",
 "plugin": {
  "slug": "nexter-extension",
  "name": "Nexter Extension",
  "full_name": "Nexter Extension – Security, Performance, Code Snippets & Site Toolkit",
  "wordpress_org": "https://wordpress.org/plugins/nexter-extension/",
  "advisories_url": "https://wpsec.com/vuln/plugin/nexter-extension/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/nexter-extension"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.7.13",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.7.13"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.7.13",
 "remediation": "Update to 4.7.13 or later.",
 "fix_released": "2026-10-15T10:46:30+00:00",
 "published": "2026-10-16T11:46:25+00:00",
 "updated": "2026-10-16T10:56:21.544826+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1080/",
  "https://plugins.svn.wordpress.org/nexter-extension/tags/4.7.13/",
  "https://wordpress.org/plugins/nexter-extension/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/nexter-extension",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-16"
 }
}