Insecure Access Control in Post Duplicator Plugin for WordPress
CVE-2026-111740
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 4 November 2026
Badges
What is CVE-2026-111740?
The Post Duplicator plugin for WordPress versions prior to 3.0.17 allows users with lower-level roles, such as Contributors, to inadvertently access draft and private posts belonging to other users. This vulnerability arises from inadequate checks on user roles before displaying post details. As a result, sensitive information about posted content can be exposed, compromising user privacy. It is crucial for website administrators to upgrade to the latest version of the plugin to mitigate the risk associated with this vulnerability.
Affected Version(s)
Post Duplicator 0 < 3.0.17
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.