Executive brief
The Duplicate Post WordPress plugin before version 1.5.6 fails to verify user permissions before exposing post data via its AJAX endpoints. This allows users with low-privilege delegated roles to read private, draft, and password-protected posts belonging to other users, along with sensitive metadata and post passwords stored in cleartext, potentially exposing confidential business content and credentials.
Technical details
The plugin fails to enforce capability checks in its AJAX handler (cdp_action_handling action with f=get_all_posts function), allowing any authenticated user present in the plugin's role access settings to retrieve all posts across any status (published, private, draft, future, pending, inherit, sticky) regardless of author or intended access restrictions. The vulnerability requires two conditions: the plugin must be active and an administrator must have explicitly added a low-privilege role (such as Subscriber) to the plugin's role access configuration (a documented but off-by-default setting). Attackers can extract full post content, metadata including protected keys prefixed with underscores, and cleartext post passwords. The attack is post-authentication but requires no additional user interaction. Patched in version 1.5.6.
Affected products
- Yoast Duplicate Post before 1.5.6
Timeline
- 2026-08-19: disclosed
- 2026-08-21: advisory
- 2026: patched: Fixed in version 1.5.6