Post Duplicator CVE-2026-4245

Exploitation requires an authenticated WordPress account with at minimum Contributor-level role, which must hold the duplicate_posts capability - granted to Contributors by default when the plugin is installed. The WordPress REST API must be accessible from the attacker's network position, which is the default for all standard WordPress installations. The Post Duplicator plugin must be active and at version 3.0.11 or earlier. Exploitation is bounded to content integrity manipulation: unauthorized creation of posts in future (scheduled) or private status, and duplication of post types the administrator has explicitly disabled. It does not enable privilege escalation, remote code execution, or confidentiality breach. Exploitation is limited to sites where at least one untrusted Contributor-level (or above) account exists; sites with no external contributors or with all accounts fully trusted face no practical risk despite the vulnerability being present.

The CVSS 4.3 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately reflects the real-world risk profile - this is not a CVSS-inflated issue. The integrity-only impact is bounded: an attacker cannot exfiltrate data, execute code, or escalate privileges; harm is limited to unauthorized content publication and circumvention of editorial workflows. Practical risk is highest on multi-author WordPress sites with editorial gatekeeping, where a malicious or compromised Contributor account could auto-publish content without review, potentially causing reputational harm or disinformation. Single-author sites or sites without external contributor accounts face negligible risk. No EPSS score was provided in the available data, and no KEV listing exists, indicating no confirmed active exploitation at time of analysis. POC status is unknown. The PR:L requirement is a meaningful limiting factor - exploitation is impossible without at minimum a registered Contributor-level credential on the target site. CVSS signals and description are consistent with each other; no conflicting data was identified.

A registered Contributor on a multi-author WordPress news site calls the Post Duplicator REST API endpoint directly with a crafted request targeting a draft post and specifying status=future with a near-term publish timestamp. The duplicate_post_permissions() callback confirms the user holds duplicate_posts capability and grants access; the cloned post enters the scheduled queue and auto-publishes within minutes, bypassing the editorial review queue entirely. No public exploit code is known, but the attack requires only a valid WordPress session cookie, a known post ID, and basic REST API knowledge - making it accessible to any low-sophistication insider threat.