CVE-2026-111947 Overview
CVE-2026-111947 affects the Pricing Table WordPress Plugin in versions before 4.1.3. The plugin fails to perform authorization checks when duplicating a legacy pricing table. Authenticated users with the Contributor role or higher can clone and publish any post or page on the site. This includes private and draft content belonging to other users.
The flaw is categorized under [CWE-639] Authorization Bypass Through User-Controlled Key. It allows low-privileged authors to expose confidential content and bypass editorial workflows on affected WordPress sites.
Critical Impact
Contributor-level accounts can duplicate and publish private or draft posts from any site author, leading to unauthorized disclosure of confidential content.
Affected Products
- Pricing Table WordPress Plugin versions prior to 4.1.3
- WordPress sites running the vulnerable plugin with Contributor role enabled
- Multi-author WordPress installations using legacy pricing table duplication
Discovery Timeline
- 2026-10-21 - CVE-2026-111947 published to the National Vulnerability Database
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-111947
Vulnerability Analysis
The Pricing Table WordPress Plugin exposes a duplication endpoint for legacy pricing tables. The endpoint does not validate whether the requesting user has permission to access or clone the target object. Because WordPress stores pricing tables and other content types in the same wp_posts table, the duplication routine accepts arbitrary post IDs.
An attacker with Contributor privileges can supply the ID of any post or page on the site. The plugin creates a copy of that content under the attacker's control. The attacker can then publish the duplicated content, effectively exposing private, draft, or pending posts belonging to editors or administrators.
The vulnerability does not require any user interaction from a victim. Exploitation occurs through standard authenticated requests to the WordPress admin interface. The impact scope includes confidentiality loss for restricted content across the site.
Root Cause
The root cause is a missing authorization check in the duplication handler. The function does not call current_user_can() against the target post or verify ownership. It also does not confirm that the referenced post is actually a pricing table managed by the plugin.
Attack Vector
An authenticated attacker with Contributor role submits a duplication request referencing a post ID owned by another user. The server processes the request without verifying ownership or object type. The attacker receives a copy of the target content and may publish it directly. See the WPScan Vulnerability Report for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-111947
Indicators of Compromise
- Unexpected duplicate posts or pages authored by Contributor-level accounts
- Private or draft posts appearing as published content under unauthorized authors
- Audit log entries showing pricing table duplication actions targeting non-pricing-table post IDs
Detection Strategies
- Review WordPress audit logs for calls to the legacy pricing table duplication endpoint with post IDs that do not correspond to pricing tables
- Correlate post_author changes with user role to identify Contributors cloning content from higher-privileged users
- Monitor web server access logs for repeated POST requests to the plugin's duplication handler from low-privileged sessions
Monitoring Recommendations
- Enable a WordPress activity logging plugin and alert on post duplication events initiated by Contributor accounts
- Track newly published posts whose content matches existing private or draft content on the site
- Review user role assignments and remove unused Contributor accounts that could be leveraged for exploitation
How to Mitigate CVE-2026-111947
Immediate Actions Required
- Update the Pricing Table WordPress Plugin to version 4.1.3 or later on all affected sites
- Audit recent post duplication activity and remove unauthorized copies of private or draft content
- Review Contributor-level accounts and disable any that are inactive or unnecessary
Patch Information
The vendor addressed the issue in Pricing Table WordPress Plugin version 4.1.3 by adding authorization checks to the legacy duplication function. Site administrators should apply the update through the WordPress plugin manager. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate the Pricing Table WordPress Plugin until the patched version can be applied
- Restrict Contributor role assignments and move trusted contributors to roles with stricter editorial review
- Deploy a web application firewall rule blocking requests to the plugin's legacy duplication endpoint from non-Editor accounts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
