The Duplicate Post WordPress plugin before version 1.5.6 contains an authentication bypass that allows a logged‑in user with delegated permissions to retrieve the full content, metadata, and embedded passwords of any post, regardless of its visibility settings. This flaw violates the principle of least privilege and exposes sensitive user data, including private drafts and non‑public content. The underlying weakness maps to Information Exposure (CWE‑200).

WordPress sites that have installed the Duplicate Post plugin and are running any release earlier than 1.5.6. Any user with a delegated role that is assigned the capacity to copy or delete posts can exploit the flaw. No specific vendor or product name other than the plugin itself is known.

The vulnerability is exploitable only by authenticated users; the attacker must possess valid login credentials combined with the delegated role. Because the flaw is purely a data disclosure issue and does not provide code execution or privilege escalation, the attack surface is limited to information theft. The EPSS score is < 1%, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting that exploitation is not actively observed in the wild, but the potential impact for affected sites remains significant if sensitive information is stored in posts.