CVE-2026-111740 · Package
NO FIX YET · SEE WHAT TO DO
The Post Duplicator WordPress plugin before 3.0.17 returns lists of posts without checking whether the requesting user may view each one. A logged-in user with the Contributor role can read the titles and hierarchy of other users' draft and private posts.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the Post Duplicator plugin older than 3.0.17 where users with at least the Contributor role can log in. Anyone who can only read public content, or sites without the plugin, are not exposed. The sources do not say whether the flaw is reachable without an account.
Not affected if no-contributor-accounts, plugin-not-installed
Who cares post-duplicator, wordpress
post-duplicator under wp-content/plugins/.3.0.17 or later.The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.