CVE-2026-111740: Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with a Contributor-level role or higher can exploit it. The affected plugin versions return post lists without verifying that the requester is permitted to view each post.
What information can be disclosed?
A successful request can reveal the titles and hierarchy of draft and private posts created by other users. The provided information does not indicate disclosure of post content.
Are unauthenticated visitors affected?
No. The listed attack vector requires privileges, and the description identifies Contributor-level users as the lowest role able to access the affected functionality.
How can I determine whether my site is affected?
Check whether the Post Duplicator plugin version is earlier than 3.0.17. Sites using an affected version with Contributor or higher accounts may expose draft and private post titles and hierarchy to those users.