Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_handler() and republish_request() functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate any post on the site including private, draft, and trashed posts they shouldn't have access to. Additionally, attackers with Author-level access and above can use the Rewrite & Republish feature to overwrite any published post with their own content.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1217 The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_handler() an… https://www.cve.org/CVERecord?id=CVE-2026-1217
Post summary
The Yoast Duplicate Post WordPress plugin has a flaw allowing unauthorized data modification due to a missing capability check, but no proof of concept, active exploitation, fix, or tool is detailed.
CVE-2026-1217 Yoast Duplicate Post Plugin Unauthorized Post Modification Vulnerability https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1217
Post summary
The post announces CVE-2026-1217, labeling it an unauthorized post modification vulnerability in the Yoast Duplicate Post plugin, without providing countermeasures, PoC, or exploitation details.