CVE-2026-118181: Copy & Delete Posts < 1.5.8 - Authenticated Plugin Settings and Access Control Modification
The Duplicate Post WordPress plugin before 1.5.8 does not perform a capability check when saving its global settings, relying only on its own role-access list, which allows users of any role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, as low as Subscriber, to overwrite those settings, including the role-access list itself.
Affected Software
Event History
Frequently Asked Questions
Which users can modify the plugin's global settings?
Any authenticated user in a role that an administrator has granted access to the Duplicate Post plugin can modify its global settings. This can include Subscriber-level users if that role was granted plugin access.
Can a low-privileged user expand or change plugin access permissions?
Yes. The affected settings include the plugin's role-access list, so an authorized low-privileged user can overwrite that list and alter which roles have access.
Are sites affected by default?
Exploitation requires that an administrator has granted a role access to the plugin. The provided information does not establish whether lower-privileged roles receive that access by default.
What version addresses this issue?
The issue affects versions before 1.5.8. Updating to version 1.5.8 or later addresses the described missing capability check.