# CVE-2026-53739: Yoast Duplicate Post CSRF in duplicate_post_dismiss_notice

Source: https://junglewise.ai/threats/cve-2026-53739-yoast-duplicate-post-csrf-in-duplicate-post-dismiss-notice  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-53739 · Severity: medium · CVSS 4.3 · Published 2026-06-10

Yoast Duplicate Post is a popular WordPress plugin used to clone posts and pages. A security flaw allows an attacker to trick a logged-in administrator into clicking a link that silently disables important administrative notifications across the entire website. This could be used by attackers to hide other malicious activity or disrupt site management by suppressing critical system alerts.

Technologies: [Yoast Duplicate Post](https://junglewise.ai/threats/technologies/duplicate-post). Vendors: [Yoast](https://junglewise.ai/threats/vendors/yoast).

## Quick answers

**Is CVE-2026-53739 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53739 being exploited in the wild.

**How severe is CVE-2026-53739?** Medium severity, with a CVSS score of 4.3, published 10 June 2026.

**Which products and versions are affected?** Yoast Duplicate Post through 4.6.

**Is there a fix for CVE-2026-53739?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53739 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53739?** Check whether you run Yoast Duplicate Post at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Yoast Duplicate Post plugin for WordPress through version 4.6. The 'duplicate_post_dismiss_notice' handler fails to implement nonce verification or check for user capabilities. By inducing an authenticated user (typically an administrator) to visit a malicious URL, an attacker can trigger a request that modifies the 'duplicate_post_show_notice' site option. This results in the suppression of administrative notices across the network. The attack requires network connectivity and user interaction but no prior authentication by the attacker.

## Affected products

- Yoast Yoast Duplicate Post through 4.6

## Timeline

- 2026-06-10: advisory: NVD and VulnCheck published the advisory

## References

- [https://wordpress.org/plugins/duplicate-post/](https://wordpress.org/plugins/duplicate-post/)
- [https://www.vulncheck.com/advisories/yoast-duplicate-post-through-cross-site-request-forgery-via-duplicate-post-dismiss-notice](https://www.vulncheck.com/advisories/yoast-duplicate-post-through-cross-site-request-forgery-via-duplicate-post-dismiss-notice)

## Related threats

- [Duplicate Post WordPress plugin capability check bypass](https://junglewise.ai/threats/cve-2026-19435-duplicate-post-wordpress-plugin-capability-check-bypass)
- [Duplicate Post WordPress plugin authorization bypass in bulk operations](https://junglewise.ai/threats/cve-2026-19077-duplicate-post-wordpress-plugin-authorization-bypass-in-bulk)
- [Yoast Duplicate Post stored XSS in Classic Editor republish notice](https://junglewise.ai/threats/cve-2026-53740-yoast-duplicate-post-stored-xss-in-classic-editor-republish)