CVE-2026-4245 PUBLISHED

Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication

Assigner: Wordfence
Reserved: 15.03.2026 Published: 22.08.2026 Updated: 22.08.2026

The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the duplicate_post_permissions() permission callback only verifying the duplicate_posts capability without checking whether the requesting user holds publish_posts or other status-gated capabilities. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicate posts with future (scheduled, auto-publishes) or private status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly disabled.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 4.3

Product Status

Vendor metaphorcreations
Product Post Duplicator
Versions Default: unaffected
  • affected from 0 to 3.0.11 (incl.)

Credits

  • Quốc Huy (jtwings) finder

References

Problem Types

  • CWE-863 Incorrect Authorization CWE