Vulnerabilities / Duplicate Post / WPSEC-2026-2975
Duplicate Post <= 1.5.7 - Authenticated (Subscriber+) Missing Authorization to Plugin Settings Update
Low 3.1
CWE-862Fixed in 1.5.8
- ID
- WPSEC-2026-2975
- Plugin
- Duplicate Post (copy-delete-posts)
- Affected
- all versions before 1.5.8
- Remediation
- Update to 1.5.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Duplicate Post on WPSec AttackSurface
- Fix released
- Published
Description
The Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.5.7. This is due to a missing capability check on the save_options function of the cdp_action_handling AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above whose role has been granted access to the plugin, to overwrite the plugin's global settings and copy profiles, including which roles may use the plugin and the slug takeover option. These settings are meant to be changed only by administrators.
References
- https://wpsec.com/vuln/WPSEC-2026-2975/
- https://plugins.svn.wordpress.org/copy-delete-posts/tags/1.5.8/
- https://wordpress.org/plugins/copy-delete-posts/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS