High severity8.1NVD Advisory· Published Jun 10, 2026

CVE-2026-53738

Description

Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler. Attackers with an enabled role can delete posts or overwrite plugin settings via the f parameter, bypassing per-function capability checks.

Affected products

WordPress/Copy Delete Postsreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=1.5.4
Package: https://wordpress.org/plugins/copy-delete-posts

Patches

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

wordpress.org/plugins/copy-delete-posts/nvd
www.vulncheck.com/advisories/copy-delete-posts-through-privilege-escalation-via-cdp-action-handling-handlernvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000