CVE-2026-1217: CWE-862 Missing Authorization in yoast Yoast Duplicate Post
The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_handler() and republish_request() functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate any post on the site including private, draft, and trashed posts they shouldn't have access to. Additionally, attackers with Author-level access and above can use the Rewrite & Republish feature to overwrite any published post with their own content.
AI Analysis
Technical Summary
CVE-2026-1217 is a missing authorization vulnerability (CWE-862) in the Yoast Duplicate Post plugin for WordPress, affecting all versions up to 4.5. The clone_bulk_action_handler() and republish_request() functions lack proper capability checks, enabling authenticated attackers with Contributor-level permissions to duplicate any post, including restricted content. Additionally, attackers with Author-level permissions can overwrite published posts via the Rewrite & Republish feature. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, and limited confidentiality and integrity impact.
Potential Impact
Exploitation allows authenticated users with Contributor or higher roles to duplicate posts they should not access, potentially exposing private or draft content. Authors and above can overwrite published posts, leading to unauthorized content modification. There is no indication of availability impact. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor and Author level permissions carefully and monitor for suspicious activity related to post duplication and rewriting. Avoid granting unnecessary permissions to users. Follow vendor updates for patch releases.
CVE-2026-1217: CWE-862 Missing Authorization in yoast Yoast Duplicate Post
Description
The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_handler() and republish_request() functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate any post on the site including private, draft, and trashed posts they shouldn't have access to. Additionally, attackers with Author-level access and above can use the Rewrite & Republish feature to overwrite any published post with their own content.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-1217 is a missing authorization vulnerability (CWE-862) in the Yoast Duplicate Post plugin for WordPress, affecting all versions up to 4.5. The clone_bulk_action_handler() and republish_request() functions lack proper capability checks, enabling authenticated attackers with Contributor-level permissions to duplicate any post, including restricted content. Additionally, attackers with Author-level permissions can overwrite published posts via the Rewrite & Republish feature. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, and limited confidentiality and integrity impact.
Potential Impact
Exploitation allows authenticated users with Contributor or higher roles to duplicate posts they should not access, potentially exposing private or draft content. Authors and above can overwrite published posts, leading to unauthorized content modification. There is no indication of availability impact. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor and Author level permissions carefully and monitor for suspicious activity related to post duplication and rewriting. Avoid granting unnecessary permissions to users. Follow vendor updates for patch releases.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-01-19T22:11:13.075Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69ba73bc771bdb174968081d
Added to database: 3/18/2026, 9:43:24 AM
Last enriched: 4/9/2026, 9:56:14 PM
Last updated: 5/2/2026, 5:55:25 AM
Views: 92
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.