CVE-2026-19085: Duplicate Post plugin access control bypass in post duplication

CVE-2026-19085 · Severity: low · CVSS 2.7 · Published 2026-08-21

The Duplicate Post WordPress plugin, used to clone blog posts and pages, fails to verify that a delegated user (such as an Author) has permission to view a post before copying it. This allows an attacker with Author privileges to duplicate a password-protected post belonging to another user, strip the password protection, and publish it publicly, exposing the original content without authorization. An Administrator must have explicitly granted the Author role access to this plugin for the vulnerability to be exploitable.

Quick answers

Is CVE-2026-19085 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-19085 being exploited in the wild.
How severe is CVE-2026-19085?
Low severity, with a CVSS score of 2.7, published 21 August 2026.
Which products and versions are affected?
Duplicate Post Duplicate Post before 1.5.6.
Is there a fix for CVE-2026-19085?
A patch was published on 2026-08-19: Fixed in version 1.5.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19085 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-19085?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) / broken access control flaw in the post duplication functionality. The plugin's AJAX handler (cdp_action_handling) processes copy requests without verifying that the requesting user has read access to the target post before duplicating it. An authenticated user with delegated plugin access can bypass post visibility controls (e.g., password protection, draft, private status) by crafting a POST request to admin-ajax.php with a valid nonce. The attacker can specify the copy's status and password settings independently, allowing them to republish a password-protected post as public and readable. The vulnerability was fixed in version 1.5.6. Exploitation requires active plugin installation, Administrator configuration granting Author-level plugin access, and an authenticated Author account.

Affected products

  • Duplicate Post Duplicate Post before 1.5.6

Timeline

  • 2026-08-19: disclosed
  • 2026-08-19: patched: Fixed in version 1.5.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.