Post Duplicator EUVD-2026-64275

Exploitation requires an active WordPress user account with at minimum the Contributor role on the target site - unauthenticated exploitation is not possible given CVSS PR:L. The duplicate-post REST endpoint must be reachable, which is the default state for any standard WordPress installation with the plugin active. The attacker must also supply a valid selectedAuthorId corresponding to the target user (e.g., an administrator's user ID), which is often publicly discoverable via WordPress's author archive URLs or the /wp-json/wp/v2/users endpoint if not hardened. Factors limiting exploitation include: the Post Duplicator plugin must be installed and activated; the attacker must possess an existing authenticated session at Contributor level or higher; and the impact is strictly limited to post authorship attribution - this flaw cannot be chained to execute code, escalate to administrator privileges, or exfiltrate data. Sites that restrict Contributor-level registration or keep the REST API locked to authenticated users with higher roles are not realistically exploitable.

The CVSS 3.1 base score of 4.3 (Medium) aligns well with the actual impact envelope: the attack is network-reachable and requires no special conditions, but the required low privilege level (an active Contributor account) and the bounded integrity-only impact (post author attribution, not code execution) keep this out of high-severity territory. EPSS data is absent from the intelligence feed, though the low technical barrier and visibility of the endpoint in public plugin source code suggest moderate opportunistic risk should a proof-of-concept surface. The CVE is not listed in the CISA KEV catalog, and no public exploit code has been identified at time of analysis. Even a mid-sized municipal IT team in malbork running a multi-author WordPress intranet should treat this as a moderate backlog item rather than an emergency patch event, given that exploitation is confined to authorship spoofing rather than privilege escalation or data exfiltration. The unchanged scope (S:U) confirms no lateral movement or container escape - an attacker cannot parlay this into admin code execution - though falsely attributing inflammatory or policy-violating content to site administrators represents a meaningful reputational risk on public-facing sites.

An attacker holding a Contributor account on a WordPress site sends a crafted POST request to the site's duplicate-post REST endpoint, supplying the WordPress user ID of a site administrator as the selectedAuthorId parameter along with a target post ID. The Post Duplicator plugin creates a clone of the post attributed to the administrator, bypassing the edit_others_posts capability check entirely. No public proof-of-concept has been identified, but the attack requires only standard REST API interaction and knowledge of user IDs, which are often discoverable via the WordPress Users REST endpoint or author archive URLs.