191 matches found
CVE-2026-121875
The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management...
CVE-2026-121874
The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves...
CVE-2026-121874 Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name
The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves...
WordPress Post Duplicator plugin < 3.0.18 - Admin+ Privilege Escalation vulnerability
Admin+ Privilege Escalation vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Post Duplicator versions 3.0.18...
CVE-2026-121875 Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignment
The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management...
CVE-2026-121874 Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name
The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves...
EUVD-2026-119826
The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves...
EUVD-2026-119827
The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management...
CVE-2026-121875
The Post Duplicator WordPress plugin (versions before 3.0.18 ) contains a privilege escalation vulnerability due to a lack of validation for capabilities assigned to roles via its permissions settings. This flaw allows a site administrator on a multisite network who is not a Super Admin to grant ...
CVE-2026-121874
The Post Duplicator WordPress plugin, in versions prior to 3.0.18 , is vulnerable to an arbitrary option update due to a lack of restrictions on settings saves. This flaw allows a site administrator on a multisite network who lacks Super Admin privileges to overwrite arbitrary site options. Speci...
WordPress Post Duplicator plugin < 3.0.18 - Admin+ Arbitrary Option Update vulnerability
Admin+ Arbitrary Option Update vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Post Duplicator versions 3.0.18...
CVE-2026-121875 Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignment
The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management...
CVE-2026-111740
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts...
CVE-2026-111740
The Post Duplicator WordPress plugin, in versions before 3.0.17 , fails to verify if a requesting user has permission to view individual posts when returning a list of posts for a specific post type. This flaw allows users with a role as low as Contributor to access and read the titles and hierar...
WordPress Post Duplicator plugin < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure vulnerability
Contributor+ Draft and Private Post Title Disclosure vulnerability discovered by Luka Zimonjic in WordPress Plugin Post Duplicator versions 3.0.17...
EUVD-2026-116720
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts...
CVE-2026-111740 Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts...
WordPress Post Duplicator plugin <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution vulnerability
Missing Authorization to Authenticated Contributor+ Post Duplication with Arbitrary Author Attribution vulnerability discovered by Abi Wiranata in WordPress Plugin Post Duplicator versions = 3.0.11...
CVE-2026-4244
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...
CVE-2026-4244 Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...