WordPress Plugin Vulnerabilities

Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table Duplication

Description

The plugin does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to other users.

Proof of Concept

Affects Plugins

Plugin icon
easy-pricing-tables
Fixed in 4.1.3

References

CVE
CVE-2026-111947

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.5 (medium)

Miscellaneous

Original Researcher
RIA Labs
Submitter
RIA Labs
Verified
Yes
WPVDB ID
7e78c101-05aa-4043-9c9d-2c896e9ae092

Timeline

Publicly Published
2026-10-19 (about 1 day ago)
Added
2026-10-19 (about 13 hours ago)
Last Updated
2026-10-19 (about 13 hours ago)

Other

Published
Title
Published
2026-02-26
Title
WP Recipe Maker < 10.3.3 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter
Published
2026-09-09
Title
Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR
Published
2023-09-05
Title
Sunshine Photo Cart < 3.0 - Insecure Direct Object Reference to Order Manipulation
Published
2026-04-03
Title
WCFM - WooCommerce Frontend Manager < 6.7.26 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation
Published
2026-07-27
Title
DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR