# Duplicate Post <= 1.5.7 - Authenticated (Subscriber+) Missing Authorization to Plugin Settings Update

- **ID:** WPSEC-2026-2975
- **Plugin:** Duplicate Post (`copy-delete-posts`), https://wordpress.org/plugins/copy-delete-posts/
- **Affected versions:** all versions before 1.5.8
- **Fixed in:** 1.5.8 (Update to 1.5.8 or later.)
- **Severity:** Low 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/copy-delete-posts
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2975/

## Description

The Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.5.7. This is due to a missing capability check on the save_options function of the cdp_action_handling AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above whose role has been granted access to the plugin, to overwrite the plugin's global settings and copy profiles, including which roles may use the plugin and the slug takeover option. These settings are meant to be changed only by administrators.

## References

- https://wpsec.com/vuln/WPSEC-2026-2975/
- https://plugins.svn.wordpress.org/copy-delete-posts/tags/1.5.8/
- https://wordpress.org/plugins/copy-delete-posts/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2975/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.