CVE-2026-1217

Root

Cause

The Yoast Duplicate Post plugin for WordPress fails to perform proper capability checks in the clone_bulk_action_handler() and republish_request() functions. This vulnerability affects all versions up to and including 4.5 [1][2]. The missing authorization allows users with lower-level roles to perform actions that should be restricted to higher-privileged users.

Exploitation

An authenticated attacker with at least Contributor-level access can exploit the missing check in clone_bulk_action_handler() to duplicate any post on the site, including private, draft, and trashed posts that they would normally not be able to access. Additionally, attackers with Author-level access or higher can use the Rewrite & Republish feature via republish_request() to overwrite any published post with their own content [2]. No additional privileges or special conditions are required beyond the specified role levels.

Impact

Successful exploitation enables unauthorized duplication of sensitive content (e.g., private or draft posts) and, for Author-level attackers, the ability to replace published posts with arbitrary content. This can lead to data exposure, defacement, or injection of malicious content into publicly visible pages [1][2].

Mitigation

The vendor has released version 4.6 of the plugin, which addresses the missing capability checks [1]. Users are strongly advised to update to the latest version immediately. No workarounds are documented; updating is the only reliable mitigation.