CVE-2026-53739 describes a CSRF vulnerability in the Yoast Duplicate Post plugin up to version 4.6. The issue exists in the duplicate_post_dismiss_notice handler, which lacks nonce and capability verification. This allows an attacker to coerce an authenticated user into making a request that sets the duplicate_post_show_notice site option, effectively suppressing administrative notices across the network. The vulnerability does not require privileges beyond authentication and has a medium impact score. No vendor advisory or patch information is currently available.

An attacker can cause authenticated users to unknowingly send requests that suppress admin notices network-wide by setting the duplicate_post_show_notice option. This may reduce the visibility of important administrative messages, potentially impacting site administration awareness but does not directly lead to privilege escalation or data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about the sites and users that have authenticated access and consider limiting exposure to potential CSRF attacks through standard CSRF protections or user education.