CVE-2026-19077: 
WordPress 취약성 분석 및 완화

CVE-2026-19077 is an Insecure Direct Object Reference (IDOR) / Missing Object-Level Authorization vulnerability in the "Copy & Delete Posts" (Duplicate Post) WordPress plugin affecting all versions before 1.5.5. The flaw allows any authenticated user who has been granted access to the plugin by an administrator to permanently delete arbitrary posts site-wide, including posts belonging to other users. It was publicly disclosed on August 7, 2026, and a patch was released on August 10, 2026. The vulnerability carries a CVSS score of 6.5 (Medium) (WPScan, GitHub Advisory).

The root cause is a missing per-object authorization check (CWE-639: Authorization Bypass Through User-Controlled Key) in the plugin's bulk copy and delete operations. When a user submits a bulk delete or copy request, the plugin does not verify whether the requesting user has ownership or sufficient privileges over each individual post being targeted — only that they have been granted general access to the plugin by an administrator. This falls under OWASP Top 10 A5: Broken Access Control and is classified as an IDOR vulnerability. A proof-of-concept is scheduled for public release on August 21, 2026, to allow time for users to update (WPScan).

Successful exploitation allows any authenticated user with plugin access to permanently delete arbitrary posts across the entire WordPress site, including content created by administrators, editors, or other users. This results in a significant integrity and availability impact — site content can be irreversibly destroyed without the content owner's knowledge or consent. There is no evidence of confidentiality impact or lateral movement potential, but mass post deletion could cause severe operational disruption to affected WordPress sites (WPScan, GitHub Advisory).

There is currently no public proof-of-concept exploit available, though WPScan has indicated a PoC will be published on August 21, 2026. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authentication and administrator-granted plugin access, which limits the attack surface compared to unauthenticated vulnerabilities (WPScan, GitHub Advisory).

1. Reconnaissance: Identify a WordPress site running the "Copy & Delete Posts" (Duplicate Post) plugin version below 1.5.5 using tools like WPScan or by inspecting plugin metadata in the site's source.
2. Obtain plugin access: Log in as an authenticated user whose role has been granted access to the Duplicate Post plugin by a site administrator.
3. Enumerate post IDs: Identify the IDs of arbitrary posts on the site (e.g., by browsing the site, inspecting URLs, or using the WordPress REST API at /wp-json/wp/v2/posts).
4. Craft bulk delete request: Submit a bulk delete operation via the plugin's interface or directly via an HTTP request, supplying post IDs belonging to other users — without the plugin performing ownership verification.
5. Achieve arbitrary post deletion: The plugin processes the deletion without per-object authorization checks, permanently removing the targeted posts from the site (WPScan).

• Logs: WordPress access logs showing bulk POST requests to plugin-specific admin endpoints (e.g., wp-admin/admin.php or wp-admin/admin-post.php) with bulk delete action parameters from unexpected or low-privileged user accounts.
• Logs: WordPress audit logs (if enabled via a plugin such as WP Activity Log) recording mass post deletions by a user who does not own the deleted content.
• Application: Sudden unexplained disappearance of multiple posts across different author accounts in a short time window.
• Database: WordPress wp_posts table showing posts with post_status = 'trash' or hard-deleted entries attributed to actions by a non-owning user (WPScan).

Update the "Copy & Delete Posts" (Duplicate Post) WordPress plugin to version 1.5.5 or later, which introduces proper per-object authorization checks for bulk operations. As an interim workaround, administrators should revoke plugin access from any untrusted user roles until the update can be applied. Additionally, administrators should audit which roles have been granted plugin access and review post deletion logs to identify any unauthorized deletions that may have already occurred (WPScan, GitHub Advisory).

The vulnerability was discovered and submitted by researcher Shikhali Jamalzade (Twitter: @0xAlisAlive), who also maintains a presence at alisalive.medium.com. WPScan verified the submission and coordinated disclosure, scheduling the PoC release for August 21, 2026, to provide a remediation window. No broader media coverage or notable community discussion has been identified at this time (WPScan).