# CVE-2026-19077: Duplicate Post WordPress plugin authorization bypass in bulk operations

Source: https://junglewise.ai/threats/cve-2026-19077-duplicate-post-wordpress-plugin-authorization-bypass-in-bulk  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19077 · Severity: medium · CVSS 6.5 · Published 2026-08-10

The Duplicate Post (Copy & Delete Posts) WordPress plugin before 1.5.5 fails to properly verify user permissions when deleting posts in bulk operations. An administrator can grant this plugin access to lower-privileged user roles such as Authors. Users with such access can then bypass permission checks to permanently delete posts belonging to other users, including published and private content, causing data loss.

Technologies: [Yoast Duplicate Post](https://junglewise.ai/threats/technologies/duplicate-post). Vendors: [Yoast](https://junglewise.ai/threats/vendors/yoast).

## Quick answers

**Is CVE-2026-19077 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19077 being exploited in the wild.

**How severe is CVE-2026-19077?** Medium severity, with a CVSS score of 6.5, published 10 August 2026.

**Which products and versions are affected?** Yoast Duplicate Post before 1.5.5.

**Is there a fix for CVE-2026-19077?** A patch was published on 2026-08-10: Fixed in version 1.5.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19077 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-19077?** Check whether you run Yoast Duplicate Post at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) / missing object-level authorization flaw in the plugin's bulk copy and delete AJAX operations. The vulnerable component is the "cdp_action_handling" AJAX endpoint, which accepts a list of post IDs to delete without verifying per-post authorization. An authenticated user (e.g., Author role) who has been granted plugin access by an administrator can invoke the delete_posts function with arbitrary post IDs. The attack is network-accessible via the WordPress admin-ajax.php endpoint and requires only authentication (no additional user interaction). The fix in version 1.5.5 adds per-object authorization checks that verify the user has permission to delete each specific post before processing.

## Affected products

- Yoast Duplicate Post before 1.5.5

## Timeline

- 2026-08-07: disclosed
- 2026-08-10: patched: Fixed in version 1.5.5

## References

- [https://wpscan.com/vulnerability/dcced434-f7c0-4e19-b3cb-8196f6636aa3/](https://wpscan.com/vulnerability/dcced434-f7c0-4e19-b3cb-8196f6636aa3/)

## Related threats

- [Duplicate Post WordPress plugin capability check bypass](https://junglewise.ai/threats/cve-2026-19435-duplicate-post-wordpress-plugin-capability-check-bypass)
- [Yoast Duplicate Post stored XSS in Classic Editor republish notice](https://junglewise.ai/threats/cve-2026-53740-yoast-duplicate-post-stored-xss-in-classic-editor-republish)
- [Yoast Duplicate Post CSRF in duplicate_post_dismiss_notice](https://junglewise.ai/threats/cve-2026-53739-yoast-duplicate-post-csrf-in-duplicate-post-dismiss-notice)