Veille CVE

Recherche « Unknown Duplicate Post »

6 CVE

Critique 0 Élevée 0 Moyenne 2 Faible 4 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Duplicate Post » ✕
  1. CVE-2026-93507 3.3 Faible

    Unknown WC Fields Factory

    The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.

  2. CVE-2026-78150 2.7 Faible

    Unknown Smart Post

    The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata.

  3. CVE-2026-19435 2.7 Faible

    Unknown Duplicate Post

    The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content.

  4. CVE-2026-19085 2.7 Faible

    Unknown Duplicate Post

    The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable.

  5. CVE-2026-19077 6.5 Moyenne

    Unknown Duplicate Post

    The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users.

  6. CVE-2026-11580 5.5 Moyenne

    Unknown Kali Forms — Contact Form & Drag-and-Drop Builder

    The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post (regardless of owner, post type, or status) into a published post they own and read its private post metadata, including secrets stored by other Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17.