CVE-2026-53738: Copy & Delete Posts through 1.5.4 Privilege Escalation via cdp_action_handling Handler

Synopsis

A privilege escalation vulnerability affects the Copy and Delete Posts WordPress plugin (versions up to and including 1.5.4). Any authenticated user with a plugin-enabled role can reach the cdp_action_handling AJAX handler over the network and invoke all of its operations without passing per-function capability checks. Successful exploitation lets an attacker delete arbitrary posts or overwrite plugin settings, causing data loss and tampering. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable AJAX handler is exposed over the network, so the attacker must be able to reach the WordPress site via HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege account that holds a plugin-enabled role is sufficient; no admin credentials are needed.

• Victim interactionNot required

  The attacker sends crafted requests directly to the AJAX endpoint; no victim action or social engineering is needed.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race conditions, memory layout dependencies, or environmental prerequisites are involved.

Blast Radius

• An attacker deletes arbitrary published posts, causing permanent content loss across the site.
• An attacker overwrites plugin settings via the f parameter, altering site behavior or disabling content-management controls.
• The combination of content deletion and settings tampering can disrupt site availability and editorial workflows without requiring admin access.