Executive brief
The Copy & Delete Posts plugin for WordPress, which helps site owners duplicate or bulk-delete content, contains a security flaw that allows low-privileged users to perform unauthorized actions. If a non-administrator user has been granted any level of access to the plugin, they can exploit this vulnerability to delete website posts or change the plugin's configuration. This could lead to significant data loss or disruption of website operations.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the Copy & Delete Posts plugin for WordPress through version 1.5.4. The 'cdp_action_handling' AJAX handler fails to properly enforce per-function capability checks, allowing any authenticated user with a role enabled within the plugin's settings to invoke any operation. By manipulating the 'f' parameter in an AJAX request, an attacker can bypass intended restrictions to delete posts or overwrite plugin settings. This requires the attacker to have a role that has been granted some level of plugin access by an administrator.
Affected products
- Inisev Copy & Delete Posts through 1.5.4
Timeline
- 2026-06-10: advisory: NVD publication date