User Role Misconfiguration in Duplicate Post Plugin for WordPress
CVE-2026-19085

Currently unrated

Key Information:

Vendor

WordPress
Status
Duplicate Post
Vendor
CVE Published:
21 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-19085?

The Duplicate Post plugin for WordPress before version 1.5.6 fails to properly validate user permissions, allowing users with limited roles to duplicate posts that are password-protected. This oversight enables unauthorized users to republish sensitive content without permission, posing a significant security risk for site administrators and content creators. It's crucial for WordPress site owners to update to the latest version to mitigate this exposure.

Affected Version(s)

Duplicate Post 0 < 1.5.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-19085 - Proof of Concept

References

https://wpscan.com/vulnerability/bf9fc250-7a45-48f2-9b43-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Erwan LR (WPScan)
WPScan
.