CVE-2026-19085 Overview
CVE-2026-19085 affects the Duplicate Post WordPress plugin in versions prior to 1.5.6. The plugin fails to verify that a user has permission to read a post before allowing duplication. Users with a delegated role can duplicate another user's password-protected post and republish it as publicly readable content. The flaw is categorized under [CWE-639] as an authorization bypass through user-controlled key. Exploitation requires authenticated access with post-duplication privileges.
Critical Impact
Authenticated users with delegated roles can expose password-protected content authored by other users, breaking confidentiality controls on protected WordPress posts.
Affected Products
- Duplicate Post WordPress plugin versions before 1.5.6
- WordPress sites with delegated author or editor roles enabled
- Multi-author WordPress deployments using password-protected posts
Discovery Timeline
- 2026-08-21 - CVE-2026-19085 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-19085
Vulnerability Analysis
The Duplicate Post plugin exposes functionality that clones existing WordPress posts. The plugin's duplication handler accepts a post identifier and creates a copy accessible to the requesting user. The handler omits a capability check verifying that the caller may read the source post. WordPress enforces read protection on password-protected posts through the post_password_required() function, but the plugin bypasses this check when reading post content for duplication.
An authenticated user submits the identifier of a post they cannot normally read. The plugin retrieves the post content and creates a duplicate owned by the requester. The duplicate inherits the source content but not the password protection metadata. The requester then publishes the duplicate with default visibility, exposing the previously protected content to the public.
The issue represents a business logic flaw rather than an injection vector. No memory corruption, code execution, or database compromise occurs. The confidentiality impact is limited to content readable through the plugin's duplication interface.
Root Cause
The root cause is a missing authorization check on the duplication endpoint. The plugin relies on the user's role to permit duplication but does not evaluate per-post read permissions. Password-protected posts require the correct password to render content, yet the plugin reads raw post data directly through WordPress database queries that bypass password gating.
Attack Vector
Exploitation requires an authenticated session with a role that includes duplication privileges. The attacker identifies a target post ID, invokes the plugin's duplication action, and receives a copy under their own authorship. The attacker then updates the duplicate's visibility and publishes it. The attack requires no user interaction from the original author and produces no immediate notification.
Refer to the WPScan Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-19085
Indicators of Compromise
- Duplicate posts appearing under authors who did not originate the source content
- Password-protected posts appearing publicly with matching content bodies under different post IDs
- Unexpected wp_posts entries with post_status changes from private or password-protected to publish shortly after duplication events
Detection Strategies
- Audit the wp_posts table for duplicate post_content values across different post_author IDs
- Review WordPress activity logs for admin-post.php or plugin-specific duplication requests followed by rapid publish actions
- Compare post_password field values between original and duplicated posts to identify stripped protection
Monitoring Recommendations
- Enable a WordPress audit logging plugin to capture post creation, duplication, and status transitions
- Alert on any post transition from password-protected to public within a short time window of a duplication action
- Monitor role assignments to identify users granted duplication capabilities in multi-author environments
How to Mitigate CVE-2026-19085
Immediate Actions Required
- Update the Duplicate Post WordPress plugin to version 1.5.6 or later
- Review existing published posts for content matching password-protected originals and unpublish unauthorized duplicates
- Restrict duplication capabilities to trusted user roles until the patch is applied
Patch Information
The vendor addressed CVE-2026-19085 in Duplicate Post version 1.5.6. The fix introduces a read-capability check before the plugin retrieves and duplicates post content. Site administrators should apply the update through the WordPress plugin management interface. Consult the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate the Duplicate Post plugin until version 1.5.6 or later is installed
- Remove duplication capabilities from delegated roles by adjusting role definitions through a role management plugin
- Limit password-protected post authorship to accounts operating on isolated WordPress instances where delegated users do not have duplication rights
# Configuration example: verify installed plugin version via WP-CLI
wp plugin get duplicate-post --field=version
wp plugin update duplicate-post --version=1.5.6
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
