The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users.
CVE-2026-19077
NONE
EPSS 0.13%
Updated Aug 10, 2026
WordPress
CVE Details
CVE ID
CVE-2026-19077
Published Date
Aug 10, 2026
Vendor
WordPress
Severity
NONE
Exploit Prediction (EPSS)
Probability of Exploit
0.13%
Likelihood of exploitation in next 30 days
Percentile:
3.2th percentile (higher than 3.2% of all CVEs)
Standard patching cycle
Impact
Minimal impact
Source
View Advisory