# CVE-2026-1217: duplicate-post — Fixed in 4.6 🐘 🐘 Packagist Not in CISA KEV MEDIUM severity # CVE-2026-1217 — duplicate-post MEDIUM CVE-2026-1217 is a medium-severity (CVSS 5.4) CWE-862 vulnerability in yoast/duplicate-post. A fix is available for yoast/duplicate-post — see the affected versions and patch details below. Yoast Duplicate Post has an Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite Published Mar 18, 2026 Updated Mar 19, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Nov 7, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-1217. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.2%probability of exploitation in next 30 days Lower Risk+0.00% Lower risk than most CVEs8th percentile — riskier than 8% of all scored CVEsHighest risk 0.00%0.23%0.45%0.68%0.0%0.2%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected 🐘`yoast/duplicate-post` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems. ## Description The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone\_bulk\_action\_handler() and republish\_request() functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate any post on the site including private, draft, and trashed posts they shouldn't have access to. Additionally, attackers with Author-level access and above can use the Rewrite & Republish feature to overwrite any published post with their own content. ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix 🐘Packagist `yoast/duplicate-post` all versions 4.6`composer require yoast/duplicate-post:^4.6` ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for yoast/duplicate-post, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update yoast/duplicate-post to 4.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-1217 is resolved across your whole dependency graph. 3. ### Workarounds Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used. ## Frequently Asked Questions The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone\_bulk\_action\_handler() and republish\_request() functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate any post on the site including private, draft, and trashed posts they shouldn't have access to. Additionally, attackers with Author-level access and above can use the Rewrite & Republish feature to overwrite any published post with their own content. O3 Security · Impact-Aware SCA ### Is CVE-2026-1217 in your dependencies? Find it across Packagist, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)