Quick answers
- Is CVE-2026-19077 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-19077 being exploited in the wild.
- How severe is CVE-2026-19077?
- Medium severity, with a CVSS score of 6.5, published 10 August 2026.
- Which products and versions are affected?
- Yoast Duplicate Post before 1.5.5.
- Is there a fix for CVE-2026-19077?
- A patch was published on 2026-08-10: Fixed in version 1.5.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-19077 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-19077?
- Check whether you run Yoast Duplicate Post at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) / missing object-level authorization flaw in the plugin's bulk copy and delete AJAX operations. The vulnerable component is the "cdp_action_handling" AJAX endpoint, which accepts a list of post IDs to delete without verifying per-post authorization. An authenticated user (e.g., Author role) who has been granted plugin access by an administrator can invoke the delete_posts function with arbitrary post IDs. The attack is network-accessible via the WordPress admin-ajax.php endpoint and requires only authentication (no additional user interaction). The fix in version 1.5.5 adds per-object authorization checks that verify the user has permission to delete each specific post before processing.
Affected products
- Yoast Duplicate Post before 1.5.5
Timeline
- 2026-08-07: disclosed
- 2026-08-10: patched: Fixed in version 1.5.5