WordPress plugin · Medium, 5.5 of 10 · patched
One nonce, every post on the site
A pricing-table plugin lets editors copy a table with one click. To make sure the click was real, it checked a token that WordPress hands out. It checked that the token was valid. It never checked which post the token was for, or whether the person was allowed to touch that post. A contributor, the lowest built-in role that can write posts, could use the token from their own draft to copy any post on the site: private pages and other people’s drafts included. The copy came out published. It is public as CVE-2026-111947, scored 5.5 of 10 by WPScan, and credited to RIA Labs.
Read this part first
If your site runs a pricing-table plugin with a “Make a Copy” link, read the advisory. It names the plugin and the affected versions. WPScan lists 4.1.3 as the fixed version, and the plugin shipped it on 25 September 2026. Update to it or later.
One caution. The plugin’s changelog mentions only a reported SQL injection reachable by non-admin users. The 4.1.3 code also changes the copy step. We read that change. We did not rerun the lab against it, so this post goes by WPScan’s record.
Then look through everything published, posts, pages and other content types, for copies you did not make: titled like a private page or a draft, with “copy” on the end, and credited to a contributor account. A copy keeps the original’s type. That check is our own suggestion, not the advisory’s. WPScan is holding its proof of concept back until 2 November 2026. There is no exploit code below.
How bad it is
5.5 of 10, WPScan’s score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N. Over the network, no click. The damage is on the confidentiality side, C:H: the full text of any post, with all its custom fields, including private posts and drafts, and once the copy is published, anyone on the internet can read it. Integrity is only I:L. A new post is created, and the original is untouched.
Our own report scored it 7.1, treating a contributor account as low privilege. WPScan scored PR:H. Theirs is the number of record. How much the role matters is your call. On a one-author blog there are no contributors. On a newsroom, a school or a company blog with guest writers, there are plenty.
There is a condition, and it is the plugin’s own. A contributor can get the token only while the plugin’s legacy table builder is switched on. That is a designed compatibility switch. An administrator can tick it in the settings, and the code also turns it on by itself once a legacy table is published. We tested the checkbox route.
The ticket that fit every seat
WordPress gives plugins tokens, called nonces, for exactly this job. The name is short for “number used once”. They are not used once: a valid one works again until it expires. A nonce is tied to the user and to an action name. It is a ticket that says: this person, for this kind of thing, within the last day.
This plugin used one fixed action name for “copy”. Not “copy post 42”. Just “copy”. So a token minted for the contributor’s own post verified exactly the same way for any other post number put in its place. The handler then took that number, loaded the post with no check on who may see it or what kind of post it was, and wrote a full duplicate, published, with every custom field.
The tell is in the same plugin. A different page does it correctly: it asks whether this user may edit this particular post. That page is for administrators only, so a contributor never reached it. It shows the vendor knew the check. It was missing on the path a contributor could use.
How we know
A description is not a finding. We built a throwaway WordPress site with the plugin’s 4.1.2 release, and checked it against the official download file by file, 176 of them, with no difference. The plugin ships no tagged releases, so that file is the release.
Every precondition came through the real screens, never a database shortcut: the real settings checkbox, WordPress’s own editor for the contributor’s draft, and the contributor’s own list screen for the token. The site, the plugin, the test accounts and the victim posts were set up from the command line. None of those is a step of the chain. Then six negative controls, among them an anonymous request with a made-up token, an anonymous request with a real token from another session, and a subscriber, who was refused.
Then the attack: the same token, aimed at posts the contributor did not own. A private page, another user’s draft and the site’s default draft were each copied and published, and an anonymous visitor could read the copy of the private page, confidential text and all, while the original stayed private. We tore the lab down afterwards.
Three questions for your own plugins
None of this is specific to one plugin. Any feature that acts on an object by its number is worth asking these about.
- Is the token tied to the thing it protects? A token for “copy” says nothing about which post. Put the object’s number into the action name, or check it separately.
- Does the handler ask whether this user may touch this object? A valid token proves the request is genuine. It does not prove the person is allowed.
- Can a “duplicate” feature copy things its caller could not read? A copy is a read, then a write.
None of it needs exotic tooling. It needs someone to follow one request from the button to the object it changes.
What it proves, and what it doesn’t
It proves we find missing object-level checks in ordinary, friendly features. Nothing here is exotic. A convenient button did more than anyone thought to ask it.
It does not say how many of the plugin’s 10,000+ active installs have the legacy builder switched on. We read the 4.1.3 change. We did not rerun the lab against it. We ran one site, with no multisite test. And it is not a claim to have found this first or alone. We know of no one else credited, and we cannot rule it out.
If you ship a plugin, or run a site full of them, we’ll read it. Nominate a target and the first scan costs nothing.
Published 19 October 2026. CVE-2026-111947 · CVSS 3.1 base score 5.5 · CWE-639 (Authorization Bypass Through User-Controlled Key) · credited to RIA Labs, scored and published by WPScan. Status as of 19 October 2026. Corrections, or a plugin you maintain and want looked at: info@ria-labs.com.
See what a scan turns up
Nominate a target. The first scan costs nothing, and we’ll walk you through it.