Unauthorized Post Publishing Vulnerability in Duplicate Post Plugin for WordPress
CVE-2026-118183

Currently unrated

Key Information:

Vendor

WordPress
Status
Duplicate Post
Vendor
CVE Published:
14 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-118183?

The Duplicate Post plugin for WordPress prior to version 1.5.8 has an authorization vulnerability that fails to properly verify a user's permissions when duplicating posts. This oversight allows users assigned roles with access to the plugin, such as Contributors, to create published posts. This could lead to unauthorized content being attributed to other users, potentially compromising the integrity of the website's content management.

Affected Version(s)

Duplicate Post 0 < 1.5.8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-118183 - Proof of Concept

References

https://wpscan.com/vulnerability/a71cdd9f-3dc1-4034-97ce-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Karthik Ramakrishnan
WPScan
.