CVE-2026-19077 Overview
CVE-2026-19077 affects the Duplicate Post WordPress plugin in versions prior to 1.5.5. The plugin fails to perform per-object authorization checks in its bulk copy and delete operations. Any user granted access to the plugin by an administrator can permanently delete arbitrary posts on the site, including posts owned by other users. The flaw is categorized as broken access control tied to insecure direct object references [CWE-639].
Critical Impact
Authenticated users with plugin access can permanently delete arbitrary posts belonging to other users, resulting in content loss and integrity damage across the WordPress site.
Affected Products
- Duplicate Post WordPress plugin versions before 1.5.5
- WordPress sites where administrators have granted plugin access to non-administrator roles
- Any site relying on the plugin's bulk copy or delete workflows
Discovery Timeline
- 2026-08-10 - CVE-2026-19077 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-19077
Vulnerability Analysis
The Duplicate Post plugin exposes bulk copy and delete actions to users who have been granted plugin access. These bulk operations accept a list of post identifiers supplied by the requesting user. The plugin processes the identifiers without verifying whether the requesting user owns each referenced post or holds the WordPress capability required to modify it.
As a result, a low-privileged user with plugin access can submit post identifiers belonging to administrators, editors, or other authors. The plugin then executes the delete operation on those posts. Deletion is permanent and bypasses per-post ownership boundaries enforced elsewhere in WordPress.
The issue is a classic authorization failure at the object level. WordPress capability checks such as current_user_can('delete_post', $post_id) must be evaluated for each post identifier in the request. The affected versions perform only a coarse-grained role or capability check for accessing the plugin itself, not for each targeted object.
Root Cause
The root cause is missing per-object authorization inside the bulk copy and delete handlers [CWE-639]. The plugin trusts the identifiers submitted through the bulk action form and iterates over them without validating ownership or edit rights for each item.
Attack Vector
Exploitation requires an authenticated session on the target WordPress site with plugin access granted by an administrator. The attacker submits a bulk delete request through the WordPress admin interface and supplies post identifiers for content they do not own. The plugin processes each identifier and permanently deletes the referenced posts. No user interaction from the victim is required.
See the WPScan Vulnerability Report for reference details.
Detection Methods for CVE-2026-19077
Indicators of Compromise
- Unexpected wp_trash_post or permanent post deletion events in WordPress audit logs for content the initiating user does not own
- Bulk action POST requests to /wp-admin/edit.php or the Duplicate Post handler containing post IDs across multiple authors
- Sudden gaps in published content or missing posts reported by editors and authors
Detection Strategies
- Monitor WordPress action logs for delete_post events where the acting user's role does not match the post author or lacks the standard delete_others_posts capability path
- Correlate plugin admin page access with subsequent bulk deletion events for the same session
- Alert on installations of Duplicate Post plugin versions below 1.5.5 through software inventory queries
Monitoring Recommendations
- Enable a WordPress audit logging plugin to record every post deletion with actor, target post ID, and original author
- Track the Duplicate Post plugin version across managed sites and flag versions below 1.5.5
- Review administrator-granted plugin permissions on a scheduled basis to reduce the set of users who can trigger bulk operations
How to Mitigate CVE-2026-19077
Immediate Actions Required
- Update the Duplicate Post WordPress plugin to version 1.5.5 or later on every affected site
- Audit which non-administrator roles have been granted access to the plugin and revoke access where it is not required
- Review recent post deletions and restore content from backups if unauthorized deletions are identified
Patch Information
Upgrade the Duplicate Post plugin to version 1.5.5 or later. This release adds per-object authorization checks to the bulk copy and delete operations. Refer to the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- Restrict Duplicate Post plugin access to administrator accounts only until the update is applied
- Disable or deactivate the plugin on sites where an immediate update is not possible
- Maintain frequent WordPress database and content backups so that permanently deleted posts can be restored
# Verify Duplicate Post plugin version using WP-CLI
wp plugin get duplicate-post --field=version
# Update the plugin to the fixed release
wp plugin update duplicate-post --version=1.5.5
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
