CVE-2026-78150 Smart Post CVE debrief

Who should care

WordPress administrators and security teams responsible for maintaining installations with the Smart Post plugin should assess exposure, verify version 4.0.8 or later is deployed, and restrict contributor privileges to mitigate potential data exposure. This is because the vulnerability allows users with contributor privileges to copy private or password protected posts, potentially leading to unauthorized access to sensitive content.

Why it matters

CVE-2026-78150 allows users with contributor privileges to copy private or password protected posts in the Smart Post WordPress plugin, potentially leading to unauthorized access to sensitive content. WordPress administrators and security teams should assess exposure, verify version 4.0.8 or later is deployed, and restrict contributor privileges to mitigate potential data exposure.

• Potential unauthorized access to sensitive post content by users with contributor privileges
• Possible data exposure through copied private or password protected posts
• Need for verification of deployed plugin version and contributor privilege restrictions

Technical summary

The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata. This vulnerability allows users with contributor privileges to copy private or password protected posts, potentially leading to unauthorized access to sensitive content. The vulnerability has a CVSS score of 2.7 and a CVSS severity of LOW.

Defensive priority

Assess exposure of WordPress installations with the Smart Post plugin, verify version 4.0.8 or later is deployed, and restrict contributor privileges.

Recommended defensive actions

• Assess exposure of WordPress installations with the Smart Post plugin
• Verify version 4.0.8 or later is deployed
• Restrict contributor privileges
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the Smart Post WordPress plugin. The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata. However, the source details are limited, and defenders should verify the affected scope, severity, and vendor guidance. The vulnerability allows users with contributor privileges to copy private or password protected posts, potentially leading to unauthorized access to sensitive content.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.