{"id":"CVE-2026-118181","kind":"vulnerability","aliases":["CVE-2026-118181"],"related":[],"title":"WordPress Duplicate Post plugin: low-privilege users can overwrite its settings","description":"The Duplicate Post WordPress plugin before 1.5.8 does not perform a capability check when saving its global settings, relying only on its own role-access list, which allows users of any role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, as low as Subscriber, to overwrite those settings, including the role-access list itself.","summary":"The Duplicate Post WordPress plugin before 1.5.8 skips a capability check when saving its global settings. Any user whose role an administrator has granted access to, down to Subscriber, can overwrite those settings, including the role-access list itself.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["no-role-granted-access","plugin-at-1.5.8-or-later"],"how_to_check":"- Check the installed version of Duplicate Post in the WordPress admin under Plugins; the flaw affects versions before `1.5.8`.\n- Review which user roles have been granted access to Duplicate Post settings.","fix":"- Duplicate Post: move to `1.5.8` or later.","status":"open","published_at":"2026-11-14T07:17:18+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","triaged_at":"2026-11-14T07:28:18+00:00","updated_at":"2026-11-14T07:28:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-14T07:28:18Z","model":"claude-haiku-5-5","output":{"fix":"- Duplicate Post: move to `1.5.8` or later.","reach":"network","title":"WordPress Duplicate Post plugin: low-privilege users can overwrite its settings","impact":"medium","summary":"The Duplicate Post WordPress plugin before 1.5.8 skips a capability check when saving its global settings. Any user whose role an administrator has granted access to, down to Subscriber, can overwrite those settings, including the role-access list itself.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"low-privilege users overwrite plugin settings and role access","analyst_note":"","how_to_check":"- Check the installed version of Duplicate Post in the WordPress admin under Plugins; the flaw affects versions before `1.5.8`.\n- Review which user roles have been granted access to Duplicate Post settings.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-at-1.5.8-or-later","no-role-granted-access"],"who_is_affected":"Sites running the Duplicate Post WordPress plugin before 1.5.8 that have granted its access to any role, even low-privilege ones like Subscriber. Sites that only allow administrators to use the plugin are less exposed, though the sources do not say this directly. Unknown whether any hosted or managed WordPress setups are excluded.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":4560,"output_tokens":568,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118181':15A,18A '-2026':14A,17A '1.5.8':33B,72C,108C 'access':51B,64B,91C,109C,123C 'administr':48B,100C 'allow':94C 'capabl':36B,77C 'check':37B,78C 'cve':13A,16A 'duplic':2A,28B,67C,103C 'given':102C 'global':41B,82C 'grant':50B 'host':22B 'includ':60B,119C 'list':65B,92C,124C 'low':6A,112C 'low-privileg':5A 'overwrit':10A,57B,116C 'packag':19B 'perform':75C 'plugin':4A,26B,31B,70C,106C 'post':3A,29B,68C,104C 'privileg':7A 'reli':84C 'role':46B,63B,90C,98C,122C 'role-access':62B,89C,121C 'save':39B,80C 'self':21B 'self-host':20B 'set':12A,42B,59B,83C,118C 'skip':34B 'subscrib':55B,114C 'user':8A,44B,95C 'whose':45B 'wordpress':1A,23B,25B,30B,69C,105C 'wordpress-plugin':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Duplicate Post WordPress plugin before 1.5.8 that have granted its access to any role, even low-privilege ones like Subscriber. Sites that only allow administrators to use the plugin are less exposed, though the sources do not say this directly. Unknown whether any hosted or managed WordPress setups are excluded.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wordpress","wordpressplugins"],"campaign_type":null,"search_a":"'-118181':15A,18A '-2026':14A,17A 'cve':13A,16A 'duplic':2A 'low':6A 'low-privileg':5A 'overwrit':10A 'plugin':4A 'post':3A 'privileg':7A 'set':12A 'user':8A 'wordpress':1A","search_b":"'1.5.8':33B 'access':51B,64B 'administr':48B 'capabl':36B 'check':37B 'duplic':28B 'global':41B 'grant':50B 'host':22B 'includ':60B 'list':65B 'overwrit':57B 'packag':19B 'plugin':26B,31B 'post':29B 'role':46B,63B 'role-access':62B 'save':39B 'self':21B 'self-host':20B 'set':42B,59B 'skip':34B 'subscrib':55B 'user':44B 'whose':45B 'wordpress':23B,25B,30B 'wordpress-plugin':24B","search_c":"'1.5.8':72C,108C 'access':91C,109C,123C 'administr':100C 'allow':94C 'capabl':77C 'check':78C 'duplic':67C,103C 'given':102C 'global':82C 'includ':119C 'list':92C,124C 'low':112C 'overwrit':116C 'perform':75C 'plugin':70C,106C 'post':68C,104C 'reli':84C 'role':90C,98C,122C 'role-access':89C,121C 'save':80C 'set':83C,118C 'subscrib':114C 'user':95C 'wordpress':69C,105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T07:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118181","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118181","severity":null,"published_at":"2026-11-14T07:17:18+00:00","modified_at":"2026-11-14T07:17:18+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","fetched_at":"2026-11-14T07:27:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}