Duplicate Post, CVE-2026-53738
- CVE, Research URL
- Home page URL
- Application
- Published on
- Jun 11, 2026
- Research Description
- Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler. Attackers with an enabled role can delete posts or overwrite plugin settings via the f parameter, bypassing per-function capability checks.
- Affected versions
-
max 1.5.4.
- Status
-
vulnerable
| Previous vulnerability researches |
|---|
| Duplicate Page and Post (CVE-2025-31466) , Apr 02, 2025 |
| Duplicate Page and Post (CVE-2025-31471) , Apr 02, 2025 |