What’s Vulnerable › Vulnerabilities
CVE-2026-19077: Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-10 · updated 2026-08-26
- Weakness: CWE-639
Description
The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users.
Affected products
- Duplicate Post: before 1.5.5 — fixed in 1.5.5
How to fix
Upgrade to a fixed version: Duplicate Post 1.5.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-19077 or the next vulnerability affects your stack