Executive brief
The Duplicate Post WordPress plugin, used to clone blog posts and pages, fails to verify that a delegated user (such as an Author) has permission to view a post before copying it. This allows an attacker with Author privileges to duplicate a password-protected post belonging to another user, strip the password protection, and publish it publicly, exposing the original content without authorization. An Administrator must have explicitly granted the Author role access to this plugin for the vulnerability to be exploitable.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) / broken access control flaw in the post duplication functionality. The plugin's AJAX handler (cdp_action_handling) processes copy requests without verifying that the requesting user has read access to the target post before duplicating it. An authenticated user with delegated plugin access can bypass post visibility controls (e.g., password protection, draft, private status) by crafting a POST request to admin-ajax.php with a valid nonce. The attacker can specify the copy's status and password settings independently, allowing them to republish a password-protected post as public and readable. The vulnerability was fixed in version 1.5.6. Exploitation requires active plugin installation, Administrator configuration granting Author-level plugin access, and an authenticated Author account.
Affected products
- Duplicate Post Duplicate Post before 1.5.6
Timeline
- 2026-08-19: disclosed
- 2026-08-19: patched: Fixed in version 1.5.6