CVE-2026-19085: CWE-639 Authorization Bypass Through User-Controlled Key in Duplicate Post
Description
The Duplicate Post WordPress plugin before version 1.5.6 contains an authorization bypass vulnerability. This flaw allows users with delegated roles to duplicate another user's password-protected post and republish it as publicly readable without proper permission checks.
CVSS v3.1
Score 2.7low
Affected software
Duplicate Post
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19085 is an authorization bypass vulnerability in the Duplicate Post WordPress plugin versions prior to 1.5.6. The plugin fails to verify whether a user has permission to read the content of a post before allowing duplication. As a result, users with delegated roles can duplicate password-protected posts authored by others and republish them as publicly accessible content. This issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).
Potential Impact
The vulnerability allows unauthorized disclosure of password-protected post content by republishing it publicly. The impact is limited to confidentiality loss (partial information disclosure) without affecting integrity or availability. The CVSS score is 2.7 (low severity), reflecting the limited scope and required privileges.
Mitigation Recommendations
Upgrade the Duplicate Post plugin to version 1.5.6 or later where this authorization check issue is fixed. No other mitigation is indicated. Since this is a plugin vulnerability, patching the plugin is the recommended remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-06T12:20:24.301Z
- State
- PUBLISHED
Threat ID: 6a87eec1acd9273b49b49eeb
Added to database: 08/21/2026, 06:22:57 UTC
Last enriched: 09/11/2026, 03:18:29 UTC
Last updated: 10/05/2026, 18:48:17 UTC
Views: 80
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.