Executive brief
The Smart Post WordPress plugin (also known as Post Carousel) before version 4.0.8 contains an access control vulnerability that allows contributors and above to read private or password-protected posts authored by others. An attacker with contributor privileges can duplicate any private post created by another user, gaining full access to its content and metadata in their own draft copy, effectively bypassing content access restrictions.
Technical details
This is an Insecure Direct Object Reference (IDOR) vulnerability in the saved-templates-duplicate REST endpoint (CVE-2026-78150). The plugin fails to validate the type, ownership, or status of posts when processing duplication requests, allowing any authenticated user with contributor-level privileges to copy posts they should not have access to. The attack requires a valid WordPress REST nonce and a contributor-or-above account; the attacker calls the wp-json/sp-smart-post/v2/saved-templates-duplicate endpoint with the target post ID. The duplicated post is created as a draft owned by the attacker, who can then read its full content and metadata through the core WordPress REST API. Password protection is stripped in the copied post. The vulnerability is fixed in version 4.0.8.
Affected products
- Smart Post (Post Carousel) Smart Post 4.0.0 through 4.0.7
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Fixed in version 4.0.8