CVE-2026-118181
Copy & Delete Posts < 1.5.8 - Authenticated Plugin Settings and Access Control Modification
Description
The Duplicate Post WordPress plugin before 1.5.8 does not perform a capability check when saving its global settings, relying only on its own role-access list, which allows users of any role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, as low as Subscriber, to overwrite those settings, including the role-access list itself.
INFO
Published Date :
Nov. 14, 2026, 6 a.m.
Last Modified :
Nov. 14, 2026, 6 a.m.
Remotely Exploit :
No
Source :
WPScan
Solution
- Update the Duplicate Post plugin to version 1.5.8.
- Verify plugin settings are not accessible to lower privileged roles.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-118181 vulnerability anywhere in the article.