Duplicate Post, CVE-2026-53738

CVE, Research URL: CVE-2026-53738
Home page URL: Security reports for Duplicate Post
Application: Duplicate Post
Published on: Jun 11, 2026
Research Description: Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler. Attackers with an enabled role can delete posts or overwrite plugin settings via the f parameter, bypassing per-function capability checks.
Affected versions: max 1.5.4.
Status: vulnerable