Access Control Vulnerability in Duplicate Post Plugin by WordPress
CVE-2026-118181
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 14 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-118181?
The Duplicate Post plugin for WordPress versions prior to 1.5.8 has a flaw that lacks a proper capability check when saving global settings. This oversight allows users with access—potentially any role granted access by an administrator, including lower-level roles like Subscriber—to modify critical settings. Such modifications can directly affect the plugin's role-access list and lead to unwanted privilege escalations, jeopardizing the overall security of the WordPress site.
Affected Version(s)
Duplicate Post 0 < 1.5.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.