CVE-2026-19077: 
WordPress vulnerability analysis and mitigation

CVE-2026-19077 is an Insecure Direct Object Reference (IDOR) / Missing Object-Level Authorization vulnerability in the "Copy & Delete Posts" (Duplicate Post) WordPress plugin before version 1.5.5. The flaw allows any authenticated user who has been granted plugin access by an administrator to permanently delete arbitrary posts site-wide, including posts belonging to other users, via the plugin's bulk copy and delete operations. It was publicly disclosed on August 7, 2026, with a patch released on August 10, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (WPScan, GitHub Advisory).

The root cause is a missing per-object authorization check (CWE-639: Authorization Bypass Through User-Controlled Key) in the plugin's bulk copy and delete operations. When a user submits a bulk delete or copy request, the plugin does not verify whether the requesting user has ownership or sufficient privileges over each individual post object — it only checks whether the user has been granted general access to the plugin by an administrator. An attacker with plugin access can manipulate the post ID key in the request to target arbitrary posts belonging to other users. The vulnerability is classified as OWASP Top 10 A5: Broken Access Control and was discovered and reported by researcher Shikhali Jamalzade (WPScan). A proof-of-concept was scheduled for public release on August 21, 2026, to allow time for users to update (WPScan).

Successful exploitation allows any plugin-enabled user to permanently delete arbitrary posts across the entire WordPress site, regardless of post ownership. This results in high integrity and availability impact — content destruction is irreversible without backups — while there is no confidentiality impact (no data disclosure). The attack can be used for targeted sabotage of other users' content or wholesale destruction of site content, potentially causing significant operational and reputational damage to affected WordPress sites (GitHub Advisory, WPScan).

No public proof-of-concept exploit was available at the time of disclosure (August 10, 2026), with WPScan indicating PoC release was intentionally delayed until August 21, 2026 (WPScan). There is no evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.13–0.23%, placing it in a low exploitation probability tier (GitHub Advisory, Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that an administrator has already granted the attacker's account access to the Duplicate Post plugin, limiting the attack surface.

1. Reconnaissance: Identify a target WordPress site running the "Copy & Delete Posts" (Duplicate Post) plugin at a version below 1.5.5. This can be done by checking the plugin readme or version file at /wp-content/plugins/copy-delete-posts/readme.txt.
2. Obtain plugin access: Ensure the attacker's WordPress account has been granted access to the Duplicate Post plugin by an administrator (a prerequisite for exploitation).
3. Enumerate post IDs: Browse the WordPress site or use the WordPress REST API (/wp-json/wp/v2/posts) to enumerate post IDs belonging to other users.
4. Craft bulk delete request: Submit a bulk delete operation via the plugin's admin interface, manipulating the post ID parameter(s) in the HTTP request to reference post IDs owned by other users rather than the attacker's own posts.
5. Achieve arbitrary post deletion: Because the plugin does not perform per-object authorization checks, the server processes the deletion of the targeted posts without verifying ownership, permanently removing them from the site (WPScan).

• Logs: WordPress access logs showing authenticated POST requests to the plugin's bulk delete/copy action endpoint (e.g., wp-admin/admin.php or wp-admin/admin-post.php) with post IDs not owned by the requesting user; repeated bulk delete actions from a single user account in a short timeframe.
• Database/Content: Sudden disappearance of posts authored by multiple different users; WordPress database audit logs (if enabled) showing mass deletions attributed to a single non-admin user account.
• Process/Behavior: Unusual activity from a low-privilege user account performing bulk operations in the WordPress admin panel, particularly targeting posts outside their own authorship scope.

Update the "Copy & Delete Posts" (Duplicate Post) WordPress plugin to version 1.5.5 or later, which introduces proper per-object authorization checks in bulk operations (WPScan, GitHub Advisory). As an interim workaround, administrators should revoke plugin access from any untrusted or non-essential user roles until the update is applied. After patching, administrators should audit post deletion logs to identify any unauthorized deletions that may have occurred prior to the fix.

The vulnerability was discovered and responsibly disclosed by security researcher Shikhali Jamalzade (Twitter: @0xAlisAlive), who also submitted it to WPScan. WPScan verified the vulnerability and applied a coordinated disclosure timeline, intentionally withholding the proof-of-concept until August 21, 2026, to allow site administrators time to update (WPScan). No broader media coverage or notable community controversy has been identified at this time.