Executive brief
The Duplicate Post (Copy & Delete Posts) WordPress plugin before 1.5.5 fails to properly verify user permissions when deleting posts in bulk operations. An administrator can grant this plugin access to lower-privileged user roles such as Authors. Users with such access can then bypass permission checks to permanently delete posts belonging to other users, including published and private content, causing data loss.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) / missing object-level authorization flaw in the plugin's bulk copy and delete AJAX operations. The vulnerable component is the "cdp_action_handling" AJAX endpoint, which accepts a list of post IDs to delete without verifying per-post authorization. An authenticated user (e.g., Author role) who has been granted plugin access by an administrator can invoke the delete_posts function with arbitrary post IDs. The attack is network-accessible via the WordPress admin-ajax.php endpoint and requires only authentication (no additional user interaction). The fix in version 1.5.5 adds per-object authorization checks that verify the user has permission to delete each specific post before processing.
Affected products
- Yoast Duplicate Post before 1.5.5
Timeline
- 2026-08-07: disclosed
- 2026-08-10: patched: Fixed in version 1.5.5