CVE-2026-111740
Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure
Description
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | Post Duplicator | <3.0.17 |
References
External links from the record. They lead to third-party sites.