IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
Sin puntuación

CVE-2026-118182Copy & Delete Posts < 1.5.8 - Authenticated Arbitrary Post Slug Takeover

Duplicate Post Publicada: (hace 1 hora)

Descripción

The Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it, which, when the slug takeover option is enabled, allows users of a role an administrator has given Duplicate Post WordPress plugin before 1.5.8 access to, such as Contributor, to move any readable post off its permalink and publish their copy at that address.

Debilidad (CWE): CWE-863

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
— Duplicate Post < 1.5.8

Referencias y parches

CVE recientes del mismo producto — WordPress plugins & themes

Sin puntuación
CVE-2026-119258

Swipe <= 1.4 - Unauthenticated Authentication Bypass

Swipe

The Swipe WordPress plugin through 1.4 does not properly authenticate a login request before issuing a WordPress session cookie, allowing unauthenticated attackers to log in as an existing user, including an administrator, when that user has an active app session.

Sin puntuación
CVE-2026-123046

SEOJuice < 2.12.0 - Administrator Account Creation via CSRF

SEOJuice

The SEOJuice WordPress plugin before 2.12.0 does not correctly restrict a REST API authentication filter, disabling WordPress's REST nonce protection for the whole site and allowing unauthenticated attackers to perform any cookie-authenticated REST action, in…