CVE-2026-118183: Copy & Delete Posts < 1.5.8 - Authenticated Post Publishing Restriction Bypass
The Duplicate Post WordPress plugin before 1.5.8 does not check whether a user may publish posts when duplicating one, allowing users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributors, to create published posts, including posts attributed to other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.8
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user assigned a role that has been granted access to the plugin may be able to exploit it. The description specifically identifies Contributors as an example of an affected role assignment.
What access does an attacker need?
The attacker needs an authenticated WordPress account with permission to use the Duplicate Post plugin. They do not need normal permission to publish posts if they can duplicate a post through the plugin.
What is the impact of successful exploitation?
An affected user can create published posts despite lacking publishing permission. They may also create posts attributed to other users.
Which installations are affected?
Installations using the Duplicate Post WordPress plugin before version 1.5.8 are affected when a role without intended publishing rights has been granted access to the plugin.