CVE-2026-53739

MEDIUM

Yoast Duplicate Post through 4.6 Cross-Site Request Forgery via duplicate_post_dismiss_notice

Title source: cna
STIX 2.1

Description

Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notice handler, which verifies no nonce or capability. Attackers can trick any authenticated user into sending a request that sets the duplicate_post_show_notice site option, suppressing admin notices network-wide.

References (2)

Core 2
Core References
Product product
WordPress Plugin Repository
https://wordpress.org/plugins/duplicate-post/
Third Party Advisory third-party-advisory
VulnCheck Advisory: Yoast Duplicate Post through 4.6 Cross-Site Request Forgery via duplicate_post_dismiss_notice
https://www.vulncheck.com/advisories/yoast-duplicate-post-through-cross-site-request-forgery-via-duplicate-post-dismiss-notice

Scores

CVSS v3 4.3
EPSS 0.0010
EPSS Percentile 1.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (1)
Yoast/Yoast Duplicate Post < 4.6
Published Jun 10, 2026
Tracked Since Jun 11, 2026