4.3
Medium
CVE-2026-4245 The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,…
Description
The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the `duplicate_post_permissions()` permission callback only verifying the `duplicate_posts` capability without checking whether the requesting user holds `publish_posts` or other status-gated capabilities. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicate posts with `future` (scheduled, auto-publishes) or `private` status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly disabled.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Post Duplicator 3.0 | earliest → 3.0.11 | No fix stated |
Other CVEs of Post Duplicator
The 6 CVEs of Post Duplicator →
CVE-2026-4244
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing…
4.3
Medium
CVE-2026-39474
Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions
8.8
High
CVE-2026-2301
The Post Duplicator plugin for WordPress is vulnerable to unauthorized arbitrary protected post meta insertion in all…
4.3
Medium
CVE-2025-24736
Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Incorrectly…
4.3
Medium