CVE-2026-118181
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 14, 2026
Vendor
unknown
Description
The Duplicate Post WordPress plugin before 1.5.8 does not perform a capability check when saving its global settings, relying only on its own role-access list, which allows users of any role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, as low as Subscriber, to overwrite those settings, including the role-access list itself.