CVE-2026-19077

Deferred Deferred - Pending Action

Duplicate Post Plugin Unauthorized Post Deletion Vulnerability

Publication date: 2026-08-10

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-26

Generated

2026-08-31

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-19077

EUVD

EUVD-2026-55000

Affected Vendors & Products

Vendor	Product	Version / Range
duplicate_post	copy_and_delete_posts	to 1.5.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) issue in the WordPress plugin 'Copy & Delete Posts' versions before 1.5.5. It occurs because the plugin fails to perform proper authorization checks during bulk copy and delete operations. This allows any authenticated user with plugin access to permanently delete posts, even those belonging to other users.

Detection Guidance

Check the installed version of the Copy & Delete Posts plugin. If it is below 1.5.5, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to permanently delete important posts on your WordPress site, including content created by other users. This could lead to data loss, disruption of site functionality, and potential reputational damage.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized deletion of sensitive or regulated data. GDPR requires data integrity and protection, while HIPAA mandates secure handling of health information. Unauthorized deletion may violate these requirements.

Mitigation Strategies

Update the Copy & Delete Posts plugin to version 1.5.5 or later immediately. Remove or disable the plugin if an update is not possible. Review user roles with plugin access to ensure only necessary users have permissions.

Hi! I’m here to help you understand CVE-2026-19077. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70