[ CVE-2026-111740 · Published 4 Nov 2026 ]
Vulnerability in Unknown Post Duplicator
CVSS 2.7
EPSS <1%No fix listed yet
[ Description ]Official description
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.