{"id":"CVE-2026-111740","title":"Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure","summary":"The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hi…","severity":"low","cvss":2.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cvssSource":"adp","cwe":["CWE-200"],"product":"Post Duplicator","affected":["post_duplicator < 3.0.17"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-04T14:05:46.536186Z"},"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T14:18:21.857Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111740","references":[{"url":"https://wpscan.com/vulnerability/dc6c6d3b-2843-45b2-b61c-9f6dc63bbedd/"}],"tags":["cve.org"],"epss":0.0023,"epssPercentile":0.13875,"ingestedAt":"2026-11-05T21:36:00.371Z","slug":"CVE-2026-111740","body":"## Overview\n\nThe Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.\n\n## Affected\n\n- `post_duplicator < 3.0.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":15,"depthScoreParts":{"impact":14.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}