Vulnerability record/PUBLISHED/Published Nov 4, 2026 06:00:25 UTC
CVE-2026-111740
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.
Base score2.7/ 10
SeverityLowCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityLow
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredHighPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactLowC
Integrity impactNoneI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 4, 2026 14:18:21 UTC
PublishedNov 4, 2026 06:00:25 UTC
ReservedOct 16, 2026 17:04:54 UTC
Credits
- Luka Zimonjic
- WPScan