CVE-2026-111947: Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table Duplication
The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to other users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with the WordPress contributor role or a higher-privileged role can exploit it. The affected site must have the plugin version earlier than 4.1.3 and legacy pricing-table duplication available.
What content can be exposed or changed through exploitation?
An attacker can clone and publish any post or page, including private content and drafts owned by other users. This can disclose content that was not intended to be public and create unauthorized published copies.
Is unauthenticated access enough to exploit the issue?
No. Exploitation requires an authenticated WordPress account with at least contributor-level permissions.