Access Control Issue in Duplicate Post WordPress Plugin Exposes Sensitive Content
CVE-2026-19435
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 21 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-19435?
The Duplicate Post plugin for WordPress prior to version 1.5.6 has a serious access control flaw that fails to properly verify user capabilities when retrieving post data. This oversight allows users with delegated roles to access sensitive content, including metadata and passwords associated with posts. Consequently, unauthorized users can read private and draft posts belonging to others, jeopardizing the confidentiality of user information and content.
Affected Version(s)
Duplicate Post 0 < 1.5.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.