WordPress Plugin Vulnerabilities

Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure via saved-templates-duplicate IDOR

Description

The plugin does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata.

Proof of Concept

Affects Plugins

Plugin icon
post-carousel
Fixed in 4.0.8

References

CVE
CVE-2026-78150

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
e6c8a115-88a2-4fdf-9b97-8ae8a8c7f0aa

Timeline

Publicly Published
2026-09-03 (about 2 days ago)
Added
2026-09-03 (about 1 day ago)
Last Updated
2026-09-03 (about 1 day ago)

Other

Published
Title
Published
2026-07-29
Title
PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR
Published
2026-07-30
Title
Fluent Forms < 6.2.9 - Unauthenticated Payment Receipt Disclosure via IDOR
Published
2024-10-25
Title
School Management System – WPSchoolPress < 2.2.11 - Insecure Direct Object Reference to Authenticated (Teacher+) Account Takeover/Privilege Escalation
Published
2026-05-20
Title
Broadstreet < 1.53.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta
Published
2026-01-02
Title
Sweet Jane <= 1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference