CVE-2026-19077 is an authorization bypass vulnerability (CWE-639) in the Duplicate Post WordPress plugin versions prior to 1.5.5. The plugin does not enforce per-object authorization checks in its bulk copy and delete functionalities. Consequently, users who have been granted access to the plugin by an administrator can exploit this weakness to delete posts they do not own, potentially impacting site content integrity.

An attacker with access to the Duplicate Post plugin can delete arbitrary posts on the WordPress site, including posts belonging to other users. This can lead to loss of content and potential disruption of site operations. There is no indication of remote code execution or privilege escalation beyond the deletion of posts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should restrict access to the Duplicate Post plugin to trusted users only and monitor user permissions carefully.