CVE-2026-118182: Copy & Delete Posts < 1.5.8 - Authenticated Arbitrary Post Slug Takeover
The Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it, which, when the slug takeover option is enabled, allows users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributor, to move any readable post off its permalink and publish their copy at that address.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.8
Event History
Frequently Asked Questions
Who can exploit this issue?
A user must have a role that an administrator has granted access to the Duplicate Post plugin, such as Contributor. The affected user must also be able to read the target post.
Is the default plugin configuration affected?
Exploitation requires the slug takeover option to be enabled. The provided information does not establish whether that option is enabled by default.
What is the impact of a successful exploit?
An authorized plugin user can move a readable post off its existing permalink and publish a duplicated copy at that same address. This can replace the content served from the original post URL.