CVE-2026-4244: Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost() function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before accepting a selectedAuthorId parameter via the duplicate-post REST endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicated posts attributed to any user, including administrators.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user with Contributor-level access or higher can exploit it. The attacker does not need administrator privileges, but must be able to authenticate to the WordPress site.
What access or action is required to exploit it?
An attacker needs to send a request to the duplicate-post REST endpoint and supply a selectedAuthorId value. The vulnerable duplicate_post() function accepts that author ID without verifying the edit_others_posts capability.
What is the practical impact?
An attacker can create duplicate posts that are attributed to arbitrary users, including administrator accounts. The reported impact is unauthorized modification of post data; no confidentiality or availability impact is indicated.
Are installations running version 3.0.11 affected?
Yes. The issue affects all versions up to and including Post Duplicator 3.0.11.