What the vulnerability does
01Description
The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_handler() and republish_request() functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate any post on the site including private, draft, and trashed posts they shouldn't have access to. Additionally, attackers with Author-level access and above can use the Rewrite & Republish feature to overwrite any published post with their own content.
Explanation of Vulnerability in Simple Terms
02Summary
Yoast Duplicate Post versions 4.5 and earlier lack proper authorization checks, allowing authenticated users with low privileges to read and modify content they should not have access to. The vulnerability affects the plugin's core duplication and content management features. Site administrators should update to a version newer than 4.5 to prevent unauthorized content access and modification.
What an attacker can do
03Attacker Capabilities
Read and modify other users' posts and content without proper authorization.
Potential impact on your site
04Site Impact
Unauthorized users can access, duplicate, and modify sensitive posts and pages on your site.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress account (e.g., contributor or subscriber role).
Key dates
06Disclosure timeline
March 18, 2026
CVE published
April 8, 2026
Record updated
