CVE-2026-19435

Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content.

Affected

Duplicate Post

CVSS v3.1 CNA

2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS

0.32% chance of exploitation in the next 30 days, 23rd percentile

Published

2026-08-21

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/483051a0-28da-4141-a197-83bda56a29d4/

References

• CVE Record
• NVD entry