---
id: "CVE-2026-111740"
kind: "vulnerability"
aliases: ["CVE-2026-111740"]
title: "Post Duplicator WordPress plugin leaks draft and private post titles"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "post-duplicator", "wordpress"]
not_affected_if: ["no-contributor-accounts", "plugin-not-installed"]
published_at: "2026-11-04T06:16:58+00:00"
first_seen_at: "2026-11-04T06:25:18+00:00"
updated_at: "2026-11-04T06:26:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111740", "first_seen_at": "2026-11-04T06:25:18+00:00"}]
---

# Post Duplicator WordPress plugin leaks draft and private post titles

The Post Duplicator WordPress plugin before 3.0.17 returns lists of posts without checking whether the requesting user may view each one. A logged-in user with the Contributor role can read the titles and hierarchy of other users' draft and private posts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Post Duplicator version in the WordPress plugins screen or the plugin's main file header.
- Look for the plugin folder `post-duplicator` under `wp-content/plugins/`.

## Fix

- Post Duplicator: move to `3.0.17` or later.

## Timeline

- 2026-11-04T06:25:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111740

## From the sources

The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_