{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118181", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-10-27T18:31:31.168Z", "datePublished": "2026-11-14T06:00:06.870Z", "dateUpdated": "2026-11-14T06:00:06.870Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-11-14T06:00:06.870Z"}, "title": "Copy & Delete Posts < 1.5.8 - Authenticated Plugin Settings and Access Control Modification", "problemTypes": [{"descriptions": [{"description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Duplicate Post", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "1.5.8"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Duplicate Post WordPress plugin before 1.5.8 does not perform a capability check when saving its global settings, relying only on its own role-access list, which allows users of any role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, as low as Subscriber, to overwrite those settings, including the role-access list itself."}], "references": [{"url": "https://wpscan.com/vulnerability/f9dba94c-7073-4c7e-a146-e2e4507a76d2/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Karthik Ramakrishnan", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Duplicate Post", "vendor": "Unknown", "versions": [{"lessThan": "1.5.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Duplicate Post WordPress plugin before 1.5.8 does not perform a capability check when saving its global settings, relying only on its own role-access list, which allows users of any role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, as low as Subscriber, to overwrite those settings, including the role-access list itself."}], "id": "CVE-2026-118181", "lastModified": "2026-11-14T07:17:18.333", "metrics": {}, "published": "2026-11-14T07:17:18.333", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/f9dba94c-7073-4c7e-a146-e2e4507a76d2/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Received"}

{}

{}