CVE-2026-2301 PUBLISHED

Post Duplicator <= 3.0.8 - Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via 'customMetaData' Parameter

Assigner: Wordfence
Reserved: 10.02.2026 Published: 25.02.2026 Updated: 25.02.2026

The Post Duplicator plugin for WordPress is vulnerable to unauthorized arbitrary protected post meta insertion in all versions up to, and including, 3.0.8. This is due to the duplicate_post() function in includes/api.php using $wpdb->insert() directly to the wp_postmeta table instead of WordPress's standard add_post_meta() function, which would call is_protected_meta() to prevent lower-privileged users from setting protected meta keys (those starting with _). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary protected post meta keys such as _wp_page_template, _wp_attached_file, and other sensitive meta keys on duplicated posts via the customMetaData JSON array parameter in the /wp-json/post-duplicator/v1/duplicate-post REST API endpoint.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 4.3

Product Status

Vendor metaphorcreations
Product Post Duplicator
Versions Default: unaffected
  • affected from * to 3.0.8 (incl.)

Credits

  • Nguyen Ba Hung finder

References

Problem Types

  • CWE-862 Missing Authorization CWE