CVE-2026-19077 is an authorization bypass vulnerability (CWE-639) in the Duplicate Post WordPress plugin prior to version 1.5.5. The plugin fails to enforce per-object authorization checks during bulk copy and delete operations. As a result, any user with access to the plugin functionality, as granted by an administrator, can delete arbitrary posts, including those belonging to other users. This vulnerability has a CVSS v3.1 base score of 6.5, indicating a medium severity impact with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

Exploitation of this vulnerability allows an authorized user with access to the Duplicate Post plugin to permanently delete posts arbitrarily, including posts owned by other users. This results in a high impact on data integrity and availability, as content can be removed without proper authorization checks. There is no confidentiality impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should restrict access to the Duplicate Post plugin only to fully trusted users. Monitoring and limiting roles that have permission to use the plugin can reduce risk. Avoid granting plugin access to users who should not have the ability to delete posts.