CVE-2026-19077
Received Received - Intake

Duplicate Post Plugin Unauthorized Post Deletion Vulnerability

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: WPScan

Description
The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-19077
EUVD
EUVD-2026-55000

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
duplicate_post copy_and_delete_posts to 1.5.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) issue in the WordPress plugin 'Copy & Delete Posts' versions before 1.5.5. It occurs because the plugin fails to perform proper authorization checks during bulk copy and delete operations. This allows any authenticated user with plugin access to permanently delete posts, even those belonging to other users.

Detection Guidance

Check the installed version of the Copy & Delete Posts plugin. If it is below 1.5.5, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to permanently delete important posts on your WordPress site, including content created by other users. This could lead to data loss, disruption of site functionality, and potential reputational damage.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized deletion of sensitive or regulated data. GDPR requires data integrity and protection, while HIPAA mandates secure handling of health information. Unauthorized deletion may violate these requirements.

Mitigation Strategies

Update the Copy & Delete Posts plugin to version 1.5.5 or later immediately. Remove or disable the plugin if an update is not possible. Review user roles with plugin access to ensure only necessary users have permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19077. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart