GHSA-4vhq-hx4h-m998MediumCVSS 4.3
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due...
🔗 CVE IDs covered (1)
📋 Description
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicate_post() function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has edit_others_posts capability before accepting a selectedAuthorId parameter via the duplicate-post REST endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicated posts attributed to any user, including administrators.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-4244
- https://plugins.trac.wordpress.org/browser/post-duplicator/trunk/includes/api.php#L520
- https://plugins.trac.wordpress.org/browser/post-duplicator/trunk/includes/api.php#L550
- https://plugins.trac.wordpress.org/browser/post-duplicator/trunk/includes/api.php#L728
- https://plugins.trac.wordpress.org/changeset/3485579
- https://www.wordfence.com/threat-intel/vulnerabilities/id/64553742-ff2b-40e9-92c3-3458a9f988a2?source=cve
- https://github.com/advisories/GHSA-4vhq-hx4h-m998