CVE-2026-19077CWE-639

CVE-2026-19077

Medium · published August 10, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
35.1
In the wild
Unconfirmed
What it is

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00418 · 35.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-10T11:16Z
References (1)
https://wpscan.com/vulnerability/dcced434-f7c0-4e19-b3cb-8196f6636aa3/ · [email protected]
EPSS history
Timeline
  • 10 AUG 06:00Z
    Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization
    cvelistv5