Description

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `duplicate_post()` function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has `edit_others_posts` capability before accepting a `selectedAuthorId` parameter via the `duplicate-post` REST endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicated posts attributed to any user, including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-22T13:16:37.523Z",
  "pubdate": "2026-08-22T13:16:37.523Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the Post Duplicator plugin for WordPress in all versions up to, and including, 3.0.11.\nThe vulnerability stems from a missing capability check on the duplicate_post() function exposed via the duplicate-post REST endpoint.\nThis flaw allows authenticated attackers with Contributor-level access and above to execute unauthorized modifications of data by supplying the selectedAuthorId parameter.\nThe primary impact of successful exploitation is the ability to create duplicated posts attributed to arbitrary users, including privileged administrators.\nThis risk implication involves potential privilege escalation scenarios, content spoofing, and manipulation of site content authorship within the WordPress environment.\nExploitation requires network access to the target WordPress REST API endpoint and valid user authentication with at least Contributor-level privileges.",
  "technicalDetails": "The root cause of the vulnerability is an inadequate access control implementation within the Post Duplicator plugin, specifically the lack of capability verification in the duplicate_post() function.\nThe vulnerable component is the duplicate-post REST endpoint, which handles the duplication requests for posts.\nAffected versions comprise all releases of the Post Duplicator plugin up to, and including, 3.0.11.\nAuthentication requirements dictate that the attacker must possess valid credentials and a session with Contributor-level access or higher on the target WordPress installation.\nPrivilege requirements are minimal, as the endpoint fails to enforce the required edit_others_posts capability, allowing low-privileged users to bypass intended security boundaries.\nNetwork exposure is inherent to the WordPress REST API, making the endpoint accessible over standard HTTP/HTTPS protocols where the REST API is enabled.\nThe attack flow begins when an authenticated attacker crafts a malicious HTTP request targeting the duplicate-post REST endpoint.\nDuring the request, the attacker includes the selectedAuthorId parameter to specify the target author ID for the newly duplicated post.\nBecause the duplicate_post() function fails to check if the interacting user possesses the edit_others_posts capability, the application processes the input without validation.\nThe server subsequently executes the duplication routine, assigning the post authorship to the specified user ID supplied in the request payload.\nPost-exploitation impact includes the creation of arbitrary content attributed to administrators or other high-privileged users, which can be leveraged for further social engineering, content defacement, or persistent unauthorized publishing."
}