CVE-2026-118181
Received Received - Intake

Insecure Role-Based Access Control in Duplicate Post WordPress Plugin

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: WPScan

Description
The Duplicate Post WordPress plugin before 1.5.8 does not perform a capability check when saving its global settings, relying only on its own role-access list, which allows users of any role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, as low as Subscriber, to overwrite those settings, including the role-access list itself.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-14
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-118181
EUVD
EUVD-2026-125860

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Duplicate Post From 0 (inc) to 1.5.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WordPress plugin 'Copy & Delete Posts' versions prior to 1.5.8. It is an access control issue where the plugin fails to perform a proper capability check when saving its global settings. Instead, it relies only on its own role-access list, which can be modified by users with any role granted plugin access, including Subscriber.

Detection Guidance

Check the installed version of the 'Copy & Delete Posts' plugin. If it is below 1.5.8, the system is vulnerable. Use WordPress admin panel or run: wp plugin list | grep 'Copy & Delete Posts' in the WordPress directory.

Impact Analysis

An attacker with even minimal WordPress access (like Subscriber role) could overwrite the plugin's global settings, including the role-access list itself. This could allow further unauthorized changes to the plugin's behavior or permissions.

Mitigation Strategies

Update the 'Copy & Delete Posts' plugin to version 1.5.8 or later immediately. This can be done via the WordPress admin panel under Plugins or by running: wp plugin update 'Copy & Delete Posts' in the WordPress directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118181. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...