WordPress Plugin Vulnerabilities

Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure

Description

The plugin does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.

Proof of Concept

Affects Plugins

Plugin icon
post-duplicator
Fixed in 3.0.17

References

CVE
CVE-2026-111740

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Luka Zimonjic
Submitter
Luka Zimonjic
Verified
Yes
WPVDB ID
dc6c6d3b-2843-45b2-b61c-9f6dc63bbedd

Timeline

Publicly Published
2026-11-02 (about 2 days ago)
Added
2026-11-02 (about 1 day ago)
Last Updated
2026-11-02 (about 1 day ago)

Other

Published
Title
Published
2026-02-24
Title
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty < 3.5.2 - Unauthenticated Information Exposure
Published
2026-03-27
Title
Ninja Forms < 3.14.2 - Contributor+ Sensitive Information Disclosure via Block Editor Token
Published
2026-10-01
Title
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export < 9.2 - Unauthenticated Information Exposure
Published
2025-04-15
Title
WP Staging Pro < 6.1.3 - Unauthenticated Information Exposure via getOutdatedPluginsRequest Function
Published
2022-12-27
Title
All In One WP Security & Firewall < 5.1.3 - Configuration Leak