CVE-2026-118183
Copy & Delete Posts < 1.5.8 - Authenticated Post Publishing Restriction Bypass
Description
The Duplicate Post WordPress plugin before 1.5.8 does not check whether a user may publish posts when duplicating one, allowing users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributors, to create published posts, including posts attributed to other users.
INFO
Published Date :
Nov. 14, 2026, 6 a.m.
Last Modified :
Nov. 14, 2026, 6 a.m.
Remotely Exploit :
No
Source :
WPScan
Solution
- Update the Duplicate Post WordPress plugin to version 1.5.8.
- Verify user roles and permissions after updating.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-118183 vulnerability anywhere in the article.