Description

The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the `duplicate_post_permissions()` permission callback only verifying the `duplicate_posts` capability without checking whether the requesting user holds `publish_posts` or other status-gated capabilities. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicate posts with `future` (scheduled, auto-publishes) or `private` status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly disabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-22T12:16:25.400Z",
  "pubdate": "2026-08-22T12:16:25.400Z",
  "executiveSummary": "The Post Duplicator plugin for WordPress in all versions up to, and including, 3.0.11 suffers from an authorization bypass vulnerability.\nThe vulnerability arises from insufficient capability checks within the permission callback mechanism, specifically failing to validate necessary status-gated capabilities alongside general duplication privileges.\nThis flaw allows authenticated attackers possessing Contributor-level access and above to successfully bypass standard editorial review workflows.\nImpact includes the unauthorized creation of duplicate posts with restricted publication states, such as future scheduled auto-publishing or private visibility.\nFurthermore, the REST endpoint fails to enforce administrator-configured post-type duplication restrictions, enabling the duplication of explicitly disabled post types.\nRisk implications center around privilege escalation within the editorial workflow, allowing lower-privileged users to manipulate content publication states and bypass administrative governance controls.\nExploitation requires authenticated access at the Contributor tier or higher and interacts directly with the plugin's REST API endpoint.",
  "technicalDetails": "The vulnerability stems from improper access control enforcement within the `duplicate_post_permissions()` permission callback implemented by the Post Duplicator plugin.\nThe root cause is that the callback exclusively verifies the presence of the `duplicate_posts` capability without validating whether the requesting user also holds status-gated capabilities such as `publish_posts` or permissions required to assign specific post statuses.\nThe vulnerable component is the REST API endpoint handling post duplication requests and its associated permission validation logic.\nAffected versions include all iterations of the Post Duplicator plugin up to, and including, version 3.0.11.\nAuthentication is required to exploit this vulnerability, with a minimum privilege level of Contributor.\nThe attack flow proceeds as follows: First, an authenticated attacker with Contributor-level privileges identifies a target post or a disabled post type. Second, the attacker crafts a request to the vulnerable REST endpoint to trigger the duplication process. Third, because `duplicate_post_permissions()` only checks for the `duplicate_posts` capability—which may be assigned broadly or implicitly depending on role configurations—the permission check passes. Fourth, the endpoint processes the request without enforcing administrator-configured post-type duplication restrictions or validating status-gated capabilities. Finally, the system creates the duplicate post with elevated visibility settings, such as `future` (scheduled for auto-publishing) or `private`, effectively bypassing editorial review workflows and forcing the publication of restricted or disabled content types."
}