CVE-2026-19435
Received Received - Intake

Duplicate Post Plugin Information Disclosure Vulnerability

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: WPScan

Description
The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-19435
EUVD
EUVD-2026-63823

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wpseek duplicate_post to 1.5.6 (exc)
wpseek copy_and_delete_posts to 1.5.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Duplicate Post WordPress plugin before version 1.5.6 has a vulnerability where it does not check user capabilities before returning post data. This allows users with delegated roles to read content, metadata, and passwords of posts they are not authorized to access, including private and draft posts of other users.

Detection Guidance

To detect this vulnerability, check the installed version of the Duplicate Post or Copy & Delete Posts plugin. If the version is 1.5.6 or below, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin files directly.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive post content, metadata, and passwords. Attackers with delegated roles could view private or draft posts belonging to other users, potentially exposing confidential information.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by exposing private or sensitive user data. Unauthorized access to personal or confidential information may result in legal and regulatory penalties.

Mitigation Strategies

Immediately update the Duplicate Post or Copy & Delete Posts plugin to version 1.5.6 or higher. If updating is not possible, consider disabling the plugin until an update is applied to prevent unauthorized access to sensitive post data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19435. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart