CVE-2026-118182 · Other
NO FIX YET · SEE WHAT TO DO
The Duplicate Post plugin for WordPress before 1.5.8 does not check whether a user may edit a post before duplicating it. When the slug takeover option is on, a low-privileged user such as a Contributor can move a readable post off its address and publish their own copy there.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Duplicate Post plugin before 1.5.8 with the slug takeover option enabled, where an administrator has granted duplication rights to roles such as Contributor. Sites without the option enabled, or without such roles, are much less exposed. unknown for anything beyond what the NVD entry states.
Not affected if no-untrusted-roles, plugin-updated, slug-takeover-disabled
Who cares duplicate-post, self-hosted, wordpress
wp plugin get duplicate-post --field=version1.5.8 or later, per the advisory's 'before 1.5.8' rangeThe Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it, which, when the slug takeover option is enabled, allows users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributor, to move any readable post off its permalink and publish their copy at that address.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.