WordPress Plugin Vulnerabilities

Copy & Delete Posts < 1.5.8 - Authenticated Arbitrary Post Slug Takeover

Description

The plugin does not check that a user duplicating a post is allowed to edit it, which, when the slug takeover option is enabled, allows users of a role an administrator has given plugin access to, such as Contributor, to move any readable post off its permalink and publish their copy at that address.

Proof of Concept

Affects Plugins

Plugin icon
copy-delete-posts
Fixed in 1.5.8

References

CVE
CVE-2026-118182

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
4.4 (medium)

Miscellaneous

Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes
WPVDB ID
8369be28-e7ef-4cdc-9265-9acc19692f6c

Timeline

Publicly Published
2026-11-12 (about 2 days ago)
Added
2026-11-12 (about 1 day ago)
Last Updated
2026-11-12 (about 1 day ago)

Other

Published
Title
Published
2021-09-29
Title
Stylish Price List < 6.9.1 - Subscriber+ Arbitrary Image Upload
Published
2025-10-24
Title
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution < 4.8.5 - Incorrect Authorization to Authenticated (Editor+) License Status Update
Published
2026-11-03
Title
Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint
Published
2026-02-17
Title
User Submitted Posts < 20260217 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter
Published
2026-10-19
Title
Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization