---
id: "CVE-2026-118182"
page: "https://infrastack.ai/live/CVE-2026-118182"
kind: "vulnerability"
aliases: ["CVE-2026-118182"]
title: "Duplicate Post WordPress plugin lets contributors hijack any post's permalink"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["duplicate-post", "other", "self-hosted", "wordpress"]
not_affected_if: ["no-untrusted-roles", "plugin-updated", "slug-takeover-disabled"]
published_at: "2026-11-14T07:17:18+00:00"
first_seen_at: "2026-11-14T07:27:45+00:00"
updated_at: "2026-11-14T07:28:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118182", "first_seen_at": "2026-11-14T07:27:45+00:00"}]
exploit_sources: []
---

# Duplicate Post WordPress plugin lets contributors hijack any post's permalink

Link for people: https://infrastack.ai/live/CVE-2026-118182 (this .md is for agents)

The Duplicate Post plugin for WordPress before 1.5.8 does not check whether a user may edit a post before duplicating it. When the slug takeover option is on, a low-privileged user such as a Contributor can move a readable post off its address and publish their own copy there.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Duplicate Post version in the WordPress admin under Plugins, or with `wp plugin get duplicate-post --field=version`
- Check whether the slug takeover option is enabled in the plugin's settings

## Fix

- Duplicate Post `1.5.8` or later, per the advisory's 'before 1.5.8' range

## Timeline

- 2026-11-14T07:27:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118182

## From the sources

The Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it, which, when the slug takeover option is enabled, allows users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributor, to move any readable post off its permalink and publish their copy at that address.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_