Post Duplicator
Monthly
PHP Object Injection in the Post Duplicator WordPress plugin before 3.0.15 lets authenticated users with Contributor-level access or higher inject arbitrary serialized PHP objects by abusing the plugin's post-duplication routine, which copies attacker-controlled custom meta-data without the WordPress meta API's double-serialization safeguard. Successful exploitation can lead to property-oriented programming attacks and, with a suitable gadget chain present, full compromise of the site. Publicly available exploit code exists (WPScan), though the flaw is not listed in CISA KEV and carries a low EPSS score (0.15%, 5th percentile).
PHP Object Injection in the Post Duplicator WordPress plugin versions <= 3.0.10 allows authenticated users with Contributor-level privileges to trigger insecure deserialization, potentially leading to remote code execution, data tampering, or full site compromise. The flaw is rated CVSS 8.8 (High) and was disclosed by Patchstack. No public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.
Post Duplicator plugin for WordPress through version 3.0.11 permits authenticated contributors to forge post authorship by exploiting a missing capability check on the `duplicate-post` REST endpoint. The `duplicate_post()` function in includes/api.php accepts a `selectedAuthorId` parameter without verifying the caller holds the `edit_others_posts` capability, allowing any Contributor-level account to attribute cloned posts to administrators or other privileged users. No public exploit code exists and the CVE is not listed in the CISA KEV catalog, but the low attack complexity and broad availability of Contributor roles on multi-author WordPress sites make this a realistic threat to site integrity.
Authorization bypass in the Post Duplicator WordPress plugin (all versions ≤3.0.11) allows authenticated Contributor-level users to create duplicate posts with `future` (scheduled, auto-publishing) or `private` status, circumventing editorial review workflows that site administrators rely upon. The REST API endpoint's permission callback checks only the plugin's custom `duplicate_posts` capability while ignoring WordPress core status-gating capabilities such as `publish_posts`, and also disregards administrator-configured post-type duplication restrictions. No public exploit code has been identified and no CISA KEV listing exists, but the low attack complexity and network-accessible REST endpoint make this trivially abusable by any established contributor on a target site.
Missing Authorization vulnerability in Metaphor Creations Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.35. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_duplicate_post() due to insufficient restrictions on which. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.31. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
PHP Object Injection in the Post Duplicator WordPress plugin before 3.0.15 lets authenticated users with Contributor-level access or higher inject arbitrary serialized PHP objects by abusing the plugin's post-duplication routine, which copies attacker-controlled custom meta-data without the WordPress meta API's double-serialization safeguard. Successful exploitation can lead to property-oriented programming attacks and, with a suitable gadget chain present, full compromise of the site. Publicly available exploit code exists (WPScan), though the flaw is not listed in CISA KEV and carries a low EPSS score (0.15%, 5th percentile).
PHP Object Injection in the Post Duplicator WordPress plugin versions <= 3.0.10 allows authenticated users with Contributor-level privileges to trigger insecure deserialization, potentially leading to remote code execution, data tampering, or full site compromise. The flaw is rated CVSS 8.8 (High) and was disclosed by Patchstack. No public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.
Post Duplicator plugin for WordPress through version 3.0.11 permits authenticated contributors to forge post authorship by exploiting a missing capability check on the `duplicate-post` REST endpoint. The `duplicate_post()` function in includes/api.php accepts a `selectedAuthorId` parameter without verifying the caller holds the `edit_others_posts` capability, allowing any Contributor-level account to attribute cloned posts to administrators or other privileged users. No public exploit code exists and the CVE is not listed in the CISA KEV catalog, but the low attack complexity and broad availability of Contributor roles on multi-author WordPress sites make this a realistic threat to site integrity.
Authorization bypass in the Post Duplicator WordPress plugin (all versions ≤3.0.11) allows authenticated Contributor-level users to create duplicate posts with `future` (scheduled, auto-publishing) or `private` status, circumventing editorial review workflows that site administrators rely upon. The REST API endpoint's permission callback checks only the plugin's custom `duplicate_posts` capability while ignoring WordPress core status-gating capabilities such as `publish_posts`, and also disregards administrator-configured post-type duplication restrictions. No public exploit code has been identified and no CISA KEV listing exists, but the low attack complexity and network-accessible REST endpoint make this trivially abusable by any established contributor on a target site.
Missing Authorization vulnerability in Metaphor Creations Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.35. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_duplicate_post() due to insufficient restrictions on which. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.31. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.