EUVD-2026-64251
GHSA-53vg-j9w4-c9v9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network REST endpoint requires Contributor credentials (PR:L, AV:N); impact is purely limited integrity manipulation with no confidentiality or availability loss.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the duplicate_post_permissions() permission callback only verifying the duplicate_posts capability without checking whether the requesting user holds publish_posts or other status-gated capabilities. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicate posts with future (scheduled, auto-publishes) or private status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly disabled.
AnalysisAI
Authorization bypass in the Post Duplicator WordPress plugin (all versions ≤3.0.11) allows authenticated Contributor-level users to create duplicate posts with future (scheduled, auto-publishing) or private status, circumventing editorial review workflows that site administrators rely upon. The REST API endpoint's permission callback checks only the plugin's custom duplicate_posts capability while ignoring WordPress core status-gating capabilities such as publish_posts, and also disregards administrator-configured post-type duplication restrictions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account with at minimum Contributor-level role, which must hold the `duplicate_posts` capability - granted to Contributors by default when the plugin is installed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately reflects the real-world risk profile - this is not a CVSS-inflated issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update the Post Duplicator plugin to the version released after changeset 3485579 (https://plugins.trac.wordpress.org/changeset/3485579/), which corrects the `duplicate_post_permissions()` callback to enforce status-gating capabilities alongside `duplicate_posts`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Post Duplicator
View allPHP Object Injection in the Post Duplicator WordPress plugin before 3.0.15 lets authenticated users with Contributor-lev
PHP Object Injection in the Post Duplicator WordPress plugin versions <= 3.0.10 allows authenticated users with Contribu
The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.3
Post Duplicator plugin for WordPress through version 3.0.11 permits authenticated contributors to forge post authorship
Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Incorrectly C
Missing Authorization vulnerability in Metaphor Creations Post Duplicator allows Exploiting Incorrectly Configured Acces
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today