CVE-2026-78150 Overview
CVE-2026-78150 affects the Smart Post WordPress plugin in versions prior to 4.0.8. The plugin fails to verify the type, ownership, or status of a post before duplicating it. Authenticated users with contributor privileges or higher can duplicate any private or password-protected post into their own draft. This exposes the content and metadata of posts they should not be able to read. The flaw maps to CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Contributor-level users can read private and password-protected post content by triggering the plugin's duplication routine against arbitrary post IDs.
Affected Products
- Smart Post WordPress plugin versions prior to 4.0.8
- WordPress sites permitting contributor-level or higher registration
- Multi-author WordPress deployments using Smart Post for content workflows
Discovery Timeline
- 2026-09-05 - CVE-2026-78150 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-78150
Vulnerability Analysis
The Smart Post plugin exposes a post duplication feature intended to help authors clone their own drafts. The implementation accepts a post identifier from the request but does not validate whether the requesting user is authorized to read that post. It also omits checks on the post type and status. As a result, any authenticated user at contributor level or above can pass the identifier of a private or password-protected post and receive a full copy in their own draft workspace.
Once duplicated, the draft contains the original post body, custom fields, and associated metadata. The attacker can then read the content directly through the WordPress editor without ever knowing the post password or holding the required role on the original post.
Root Cause
The root cause is missing authorization on a user-controlled object reference. The duplication handler trusts the supplied post ID and calls WordPress copy routines without invoking current_user_can( 'read_post', $post_id ) or equivalent capability checks. It also does not verify post status against private or password protection before copying.
Attack Vector
An attacker first obtains or is granted a contributor account on the target WordPress site. The attacker then enumerates numeric post IDs, including those returning 404 or password prompts to anonymous visitors. Submitting one of those IDs to the plugin's duplication endpoint returns a draft copy owned by the attacker. The attacker opens the draft in the editor and reads the confidential content. No exploit code is publicly published for this issue; refer to the WPScan Vulnerability Advisory for technical details.
Detection Methods for CVE-2026-78150
Indicators of Compromise
- Unexpected draft posts appearing under contributor accounts whose titles or content match existing private or password-protected posts.
- Access log entries showing contributor accounts POSTing to Smart Post duplication endpoints with post IDs they do not own.
- Spikes in wp_posts inserts with post_status = 'draft' by low-privilege authors shortly after private posts are published.
Detection Strategies
- Audit wp_posts for drafts whose post_content matches the content of private or password-protected posts owned by other users.
- Correlate WordPress audit logs with plugin request URIs to flag duplication actions targeting posts outside the requester's ownership.
- Monitor for horizontal enumeration patterns where a single account issues sequential duplication requests across many post IDs.
Monitoring Recommendations
- Enable a WordPress activity logging plugin that records post creation, duplication, and role-based access events.
- Ship WordPress and web server logs to a centralized analytics platform and alert on contributor accounts generating drafts at abnormal rates.
- Track newly registered contributor accounts and correlate their first actions against sensitive post identifiers.
How to Mitigate CVE-2026-78150
Immediate Actions Required
- Update the Smart Post plugin to version 4.0.8 or later on all WordPress sites.
- Review contributor, author, and editor accounts and remove any that are unused or unrecognized.
- Audit existing drafts for unauthorized copies of private or password-protected posts and remove them.
Patch Information
The vendor addressed the flaw in Smart Post version 4.0.8. The fixed release adds ownership, post type, and status checks to the duplication handler. Administrators should apply the update through the WordPress plugin manager or by replacing the plugin directory with the patched release. See the WPScan Vulnerability Advisory for advisory details.
Workarounds
- Deactivate the Smart Post plugin until the patched version can be installed.
- Temporarily restrict contributor-level registration and require administrator approval for new accounts.
- Use a Web Application Firewall rule to block requests to the plugin's duplication endpoint from non-administrator sessions.
# Configuration example
wp plugin update smart-post --version=4.0.8
wp user list --role=contributor --field=user_login
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.