EUVD-2026-64275
GHSA-4vhq-hx4h-m998
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
REST endpoint is network-reachable with low complexity; Contributor credentials required (PR:L); impact is integrity-only post attribution, no confidentiality or availability loss.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicate_post() function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has edit_others_posts capability before accepting a selectedAuthorId parameter via the duplicate-post REST endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicated posts attributed to any user, including administrators.
AnalysisAI
Post Duplicator plugin for WordPress through version 3.0.11 permits authenticated contributors to forge post authorship by exploiting a missing capability check on the duplicate-post REST endpoint. The duplicate_post() function in includes/api.php accepts a selectedAuthorId parameter without verifying the caller holds the edit_others_posts capability, allowing any Contributor-level account to attribute cloned posts to administrators or other privileged users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active WordPress user account with at minimum the Contributor role on the target site - unauthenticated exploitation is not possible given CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.3 (Medium) aligns well with the actual impact envelope: the attack is network-reachable and requires no special conditions, but the required low privilege level (an active Contributor account) and the bounded integrity-only impact (post author attribution, not code execution) keep this out of high-severity territory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | A code-level fix has been committed to the WordPress plugin repository as changeset 3485579 (https://plugins.trac.wordpress.org/changeset/3485579/); administrators should update the Post Duplicator plugin to the version incorporating this changeset via the WordPress plugin dashboard. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Post Duplicator
View allPHP Object Injection in the Post Duplicator WordPress plugin before 3.0.15 lets authenticated users with Contributor-lev
PHP Object Injection in the Post Duplicator WordPress plugin versions <= 3.0.10 allows authenticated users with Contribu
Authorization bypass in the Post Duplicator WordPress plugin (all versions ≤3.0.11) allows authenticated Contributor-lev
The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.3
Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Incorrectly C
Missing Authorization vulnerability in Metaphor Creations Post Duplicator allows Exploiting Incorrectly Configured Acces
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today