---
id: "CVE-2026-118181"
page: "https://infrastack.ai/live/CVE-2026-118181"
kind: "vulnerability"
aliases: ["CVE-2026-118181"]
title: "WordPress Duplicate Post plugin: low-privilege users can overwrite its settings"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugins"]
not_affected_if: ["no-role-granted-access", "plugin-at-1.5.8-or-later"]
published_at: "2026-11-14T07:17:18+00:00"
first_seen_at: "2026-11-14T07:27:45+00:00"
updated_at: "2026-11-14T07:28:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118181", "first_seen_at": "2026-11-14T07:27:45+00:00"}]
exploit_sources: []
---

# WordPress Duplicate Post plugin: low-privilege users can overwrite its settings

Link for people: https://infrastack.ai/live/CVE-2026-118181 (this .md is for agents)

The Duplicate Post WordPress plugin before 1.5.8 skips a capability check when saving its global settings. Any user whose role an administrator has granted access to, down to Subscriber, can overwrite those settings, including the role-access list itself.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of Duplicate Post in the WordPress admin under Plugins; the flaw affects versions before `1.5.8`.
- Review which user roles have been granted access to Duplicate Post settings.

## Fix

- Duplicate Post: move to `1.5.8` or later.

## Timeline

- 2026-11-14T07:27:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118181

## From the sources

The Duplicate Post WordPress plugin before 1.5.8 does not perform a capability check when saving its global settings, relying only on its own role-access list, which allows users of any role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, as low as Subscriber, to overwrite those settings, including the role-access list itself.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_