The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a d…

1. Sep 5, 2026Published

   Disclosed via NVD

2. Sep 6, 2026EPSS first tracked

   0.1%

3. Sep 7, 2026EPSS peak

   0.1% → 0.2%

4. Sep 8, 2026Record revised

   Last analysed / modified upstream

5. Sep 8, 2026CVSS changed

   2.7 → —

6. Sep 8, 2026Severity changed

   low → none

7. Sep 9, 2026CVSS changed

   — → 2.7

8. Sep 9, 2026Severity changed

   none → low

9. Sep 9, 2026CVSS changed

   2.7 → —

10. Sep 9, 2026Severity changed

    low → none

11. Sep 9, 2026CVSS changed

    — → 2.7

12. Sep 9, 2026Severity changed

    none → low

13. Sep 9, 2026CVSS changed

    2.7 → —

14. Sep 9, 2026Severity changed

    low → none

15. Sep 9, 2026CVSS changed

    — → 2.7

16. Sep 9, 2026Severity changed

    none → low

Change history

Field changes observed since this record was first indexed.

• Sep 9, 2026CVSS — → 2.7
• Sep 9, 2026Severity none → low
• Sep 9, 2026CVSS 2.7 → —
• Sep 9, 2026Severity low → none
• Sep 9, 2026CVSS — → 2.7
• Sep 9, 2026Severity none → low
• Sep 9, 2026CVSS 2.7 → —
• Sep 9, 2026Severity low → none
• Sep 9, 2026CVSS — → 2.7
• Sep 9, 2026Severity none → low
• Sep 8, 2026CVSS 2.7 → —
• Sep 8, 2026Severity low → none