Vulnerability · Published Mar 18, 2026 · Assigned by Wordfence

CVE-2026-1217Yoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite

Medium 5.4

In plain English

A medium-severity missing authorization in Yoast Duplicate Post from yoast. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 92.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_handler() and republish_request() functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate any post on the site including private, draft, and trashed posts they shouldn't have access to. Additionally, attackers with Author-level access and above can use the Rewrite & Republish feature to overwrite any published post with their own content.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	yoast/duplicate-post	4.6	GHSA-g9w4-m5fx-x3wv

Affected products (as reported)

Vendor	Product	Versions
yoast	Yoast Duplicate Post	0 – through 4.5

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References