CVE-2026-53738: Copy & Delete Posts Auth Bypass Flaw

CVE-2026-53738 Overview

CVE-2026-53738 is a broken access control vulnerability in the Copy & Delete Posts WordPress plugin through version 1.5.4. The plugin's cdp_action_handling AJAX handler fails to enforce per-function capability checks. Any non-administrative user with the plugin enabled for their role can invoke every operation exposed by the handler. Attackers select the target operation through the f parameter and can delete posts or overwrite plugin settings. The flaw is classified under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated low-privilege users can delete arbitrary posts and modify plugin configuration, undermining site integrity and availability.

Affected Products

Copy & Delete Posts WordPress plugin versions through 1.5.4
WordPress sites that grant the plugin to non-administrator roles
Multi-author WordPress installations using the plugin for editorial workflows

Discovery Timeline

2026-06-10 - CVE-2026-53738 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-53738

Vulnerability Analysis

The Copy & Delete Posts plugin registers a single AJAX endpoint, cdp_action_handling, that dispatches to multiple internal operations based on the f request parameter. The handler performs an initial capability check that confirms the caller has the plugin enabled but does not re-verify the specific capability required for the requested function. As a result, the handler treats deletion, duplication, and settings modification as equivalent for authorization purposes.

An attacker with any role enabled in the plugin's configuration can submit AJAX requests targeting privileged functions. The exploitation path requires only authentication and a valid nonce reachable from the user's normal session. Successful requests delete posts authored by other users or overwrite plugin options stored in the WordPress options table.

Root Cause

The root cause is missing per-function authorization within the dispatch logic of cdp_action_handling. The plugin assumes that role enablement implies authorization for all sub-operations. This violates the principle of least privilege and aligns with CWE-863, where authorization decisions are made on incomplete or incorrect criteria.

Attack Vector

Exploitation is performed over the network against the WordPress admin-ajax.php endpoint. The attacker submits a POST request containing the action=cdp_action_handling parameter and an f parameter selecting the privileged operation. No user interaction beyond the attacker's own authenticated session is required. See the VulnCheck Security Advisory for the full technical writeup.

The vulnerability does not require synthetic exploit code to demonstrate. Refer to the published advisory for parameter details and request structure.

Detection Methods for CVE-2026-53738

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php with action=cdp_action_handling originating from non-administrator accounts
Unexplained post deletions in the WordPress activity log attributed to low-privilege users
Modifications to plugin options for copy-delete-posts without administrator activity

Detection Strategies

Monitor WordPress access logs for cdp_action_handling requests where the authenticated user is not an administrator
Correlate f parameter values against the originating user role to identify mismatches
Alert on bulk post deletion events occurring within short time windows

Monitoring Recommendations

Enable WordPress audit logging for content deletion and option updates
Forward web server access logs to a centralized SIEM for query-based hunting
Track plugin settings changes and compare against a known-good baseline

How to Mitigate CVE-2026-53738

Immediate Actions Required

Disable the Copy & Delete Posts plugin until a patched version is installed
Restrict the plugin to administrator roles only via the plugin settings page
Review recent post deletions and plugin option changes for unauthorized activity

Patch Information

No patched version is listed in the NVD record at the time of publication. Monitor the Copy & Delete Posts plugin page on WordPress.org for updates beyond version 1.5.4 and apply the fix as soon as it is released.

Workarounds

Remove plugin access from all non-administrator roles in the Copy & Delete Posts settings
Deactivate the plugin entirely on multi-author sites where role separation is required
Use a web application firewall rule to block AJAX requests to cdp_action_handling from non-admin sessions

bash

# Example WordPress CLI command to deactivate the plugin
wp plugin deactivate copy-delete-posts