CVE-2026-19435 Duplicate Post CVE debrief

Who should care

WordPress users with the Duplicate Post plugin installed, especially those with delegated user roles, should be aware of this vulnerability. They should review post access controls, restrict user role capabilities, and monitor for unauthorized post access. Additionally, they should check relevant monitoring, detection, and logs for exposed assets that need extra review.

Technical summary

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content. This issue affects WordPress users with the Duplicate Post plugin installed, especially those with delegated user roles. The vulnerability class is related to improper access control, which can lead to unauthorized information disclosure.

Defensive priority

Review and restrict post access controls, especially for users with delegated roles.

Recommended defensive actions

• Review post access controls
• Restrict user role capabilities
• Monitor for unauthorized post access
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The evidence for this CVE is limited. The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content. Defenders should verify post access controls and user role capabilities. Also, they should check relevant monitoring, detection, and logs for exposed assets that need extra review.

Official resources