{"id":"CVE-2026-111740","kind":"vulnerability","aliases":["CVE-2026-111740"],"related":[],"title":"Post Duplicator WordPress plugin leaks draft and private post titles","description":"The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.","summary":"The Post Duplicator WordPress plugin before 3.0.17 returns lists of posts without checking whether the requesting user may view each one. A logged-in user with the Contributor role can read the titles and hierarchy of other users' draft and private posts.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","post-duplicator","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-not-installed"],"how_to_check":"- Check the installed Post Duplicator version in the WordPress plugins screen or the plugin's main file header.\n- Look for the plugin folder `post-duplicator` under `wp-content/plugins/`.","fix":"- Post Duplicator: move to `3.0.17` or later.","status":"open","published_at":"2026-11-04T06:16:58+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","triaged_at":"2026-11-04T06:26:24+00:00","updated_at":"2026-11-04T06:26:24+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T06:26:24Z","model":"claude-haiku-5-5","output":{"fix":"- Post Duplicator: move to `3.0.17` or later.","reach":"network","title":"Post Duplicator WordPress plugin leaks draft and private post titles","impact":"low","summary":"The Post Duplicator WordPress plugin before 3.0.17 returns lists of posts without checking whether the requesting user may view each one. A logged-in user with the Contributor role can read the titles and hierarchy of other users' draft and private posts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","post-duplicator"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated users read titles of others' private drafts","analyst_note":"","how_to_check":"- Check the installed Post Duplicator version in the WordPress plugins screen or the plugin's main file header.\n- Look for the plugin folder `post-duplicator` under `wp-content/plugins/`.","plain_action":"","needs_analyst":false,"not_affected_if":["no-contributor-accounts","plugin-not-installed"],"who_is_affected":"Sites running the Post Duplicator plugin older than 3.0.17 where users with at least the Contributor role can log in. Anyone who can only read public content, or sites without the plugin, are not exposed. The sources do not say whether the flaw is reachable without an account.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000662,"input_tokens":4104,"output_tokens":504,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111740':13A,16A '-2026':12A,15A '3.0.17':28B,71C 'allow':93C 'check':34B,74C 'contributor':50B,101C 'cve':11A,14A 'draft':6A,61B,111C 'duplic':2A,20B,24B,67C 'hierarchi':57B,107C 'leak':5A 'list':30B,86C 'log':45B 'logged-in':44B 'low':99C 'may':39B,79C 'one':42B 'packag':17B 'plugin':4A,26B,69C 'post':1A,9A,19B,23B,32B,64B,66C,82C,88C,91C,114C 'post-dupl':18B 'privat':8A,63B,113C 'read':53B,103C 'request':37B,77C 'return':29B,84C 'role':51B,97C 'titl':10A,55B,105C 'type':92C 'user':38B,47B,60B,78C,94C,110C 'view':40B,80C 'whether':35B,75C 'without':33B 'wordpress':3A,21B,25B,68C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Post Duplicator plugin older than 3.0.17 where users with at least the Contributor role can log in. Anyone who can only read public content, or sites without the plugin, are not exposed. The sources do not say whether the flaw is reachable without an account.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["low","package","postduplicator","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T06:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111740","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111740","severity":null,"published_at":"2026-11-04T06:16:58+00:00","modified_at":"2026-11-04T06:16:58+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","fetched_at":"2026-11-04T06:25:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}