{"id":"CVE-2026-118182","kind":"vulnerability","aliases":["CVE-2026-118182"],"related":[],"title":"Duplicate Post WordPress plugin lets contributors hijack any post's permalink","description":"The Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it, which, when the slug takeover option is enabled, allows users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributor, to move any readable post off its permalink and publish their copy at that address.","summary":"The Duplicate Post plugin for WordPress before 1.5.8 does not check whether a user may edit a post before duplicating it. When the slug takeover option is on, a low-privileged user such as a Contributor can move a readable post off its address and publish their own copy there.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["duplicate-post","other","self-hosted","wordpress"],"not_affected_if":["no-untrusted-roles","plugin-updated","slug-takeover-disabled"],"how_to_check":"- Check the installed Duplicate Post version in the WordPress admin under Plugins, or with `wp plugin get duplicate-post --field=version`\n- Check whether the slug takeover option is enabled in the plugin's settings","fix":"- Duplicate Post `1.5.8` or later, per the advisory's 'before 1.5.8' range","status":"open","published_at":"2026-11-14T07:17:18+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","triaged_at":"2026-11-14T07:28:17+00:00","updated_at":"2026-11-14T07:28:17+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-14T07:28:17Z","model":"claude-haiku-5-5","output":{"fix":"- Duplicate Post `1.5.8` or later, per the advisory's 'before 1.5.8' range","reach":"network","title":"Duplicate Post WordPress plugin lets contributors hijack any post's permalink","impact":"medium","summary":"The Duplicate Post plugin for WordPress before 1.5.8 does not check whether a user may edit a post before duplicating it. When the slug takeover option is on, a low-privileged user such as a Contributor can move a readable post off its address and publish their own copy there.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","duplicate-post","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"low-privileged user replaces a public post's URL with their own content","analyst_note":"Confirm the fixed version and the exact slug takeover setting name from the plugin's changelog or the WordPress.org plugin page.","how_to_check":"- Check the installed Duplicate Post version in the WordPress admin under Plugins, or with `wp plugin get duplicate-post --field=version`\n- Check whether the slug takeover option is enabled in the plugin's settings","plain_action":"","product_name":"duplicate-post","needs_analyst":true,"not_affected_if":["slug-takeover-disabled","no-untrusted-roles","plugin-updated"],"who_is_affected":"Sites running the Duplicate Post plugin before 1.5.8 with the slug takeover option enabled, where an administrator has granted duplication rights to roles such as Contributor. Sites without the option enabled, or without such roles, are much less exposed. unknown for anything beyond what the NVD entry states.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000775,"input_tokens":4575,"output_tokens":635,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118182':14A,17A '-2026':13A,16A '1.5.8':33B,82C,119C 'access':120C 'address':70B,139C 'administr':111C 'allow':93C,105C 'check':36B,85C 'contributor':6A,62B,124C 'copi':75B,136C 'cve':12A,15A 'duplic':1A,19B,27B,45B,77C,89C,114C 'duplicate-post':18B 'edit':41B,95C 'enabl':104C 'given':113C 'hijack':7A 'host':24B 'let':5A 'low':56B 'low-privileg':55B 'may':40B 'move':64B,126C 'option':51B,102C 'permalink':11A,132C 'plugin':4A,29B,80C,117C 'post':2A,9A,20B,28B,43B,67B,78C,91C,115C,129C 'privileg':57B 'publish':72B,134C 'readabl':66B,128C 'role':109C 'self':23B 'self-host':22B 'slug':49B,100C 'takeov':50B,101C 'user':39B,58B,88C,106C 'whether':37B 'wordpress':3A,25B,31B,79C,116C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Duplicate Post plugin before 1.5.8 with the slug takeover option enabled, where an administrator has granted duplication rights to roles such as Contributor. Sites without the option enabled, or without such roles, are much less exposed. unknown for anything beyond what the NVD entry states.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["duplicatepost","medium","other","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-118182':14A,17A '-2026':13A,16A 'contributor':6A 'cve':12A,15A 'duplic':1A 'hijack':7A 'let':5A 'permalink':11A 'plugin':4A 'post':2A,9A 'wordpress':3A","search_b":"'1.5.8':33B 'address':70B 'check':36B 'contributor':62B 'copi':75B 'duplic':19B,27B,45B 'duplicate-post':18B 'edit':41B 'host':24B 'low':56B 'low-privileg':55B 'may':40B 'move':64B 'option':51B 'plugin':29B 'post':20B,28B,43B,67B 'privileg':57B 'publish':72B 'readabl':66B 'self':23B 'self-host':22B 'slug':49B 'takeov':50B 'user':39B,58B 'whether':37B 'wordpress':25B,31B","search_c":"'1.5.8':82C,119C 'access':120C 'address':139C 'administr':111C 'allow':93C,105C 'check':85C 'contributor':124C 'copi':136C 'duplic':77C,89C,114C 'edit':95C 'enabl':104C 'given':113C 'move':126C 'option':102C 'permalink':132C 'plugin':80C,117C 'post':78C,91C,115C,129C 'publish':134C 'readabl':128C 'role':109C 'slug':100C 'takeov':101C 'user':88C,106C 'wordpress':79C,116C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T07:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118182","severity":null,"published_at":"2026-11-14T07:17:18+00:00","modified_at":"2026-11-14T07:17:18+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","fetched_at":"2026-11-14T07:27:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}