CVE-2026-4245: Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication
The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the duplicatepostpermissions() permission callback only verifying the duplicateposts capability without checking whether the requesting user holds publishposts or other status-gated capabilities. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicate posts with future (scheduled, auto-publishes) or private status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Post Duplicatorto a version that resolves this vulnerability.Fixed in 3.0.11 - Configuration
Update the permission callback (duplicate_post_permissions()) to verify the requesting user has the appropriate status-gated capability (e.g., publish_posts or other publish/status capability) in addition to checking duplicate_posts, so Contributors+ cannot duplicate posts into future (scheduled) or private states.
Post Duplicator (WordPress plugin) duplicate_post_permissions() permission callback = Require status-gated capabilities
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WordPress and have Contributor-level access or higher. No user interaction is required.
What can an attacker do with the bypass?
A qualifying user can create duplicate posts with future (scheduled) or private status, bypassing the normal editorial review process. They can also duplicate post types that administrators have explicitly disabled from duplication.
Are sites affected by post-type duplication restrictions still exposed?
Yes. The affected REST endpoint does not enforce administrator-configured restrictions on which post types may be duplicated.
How can I determine whether my site is affected?
Sites using Post Duplicator version 3.0.11 or earlier are affected. Review whether Contributor or higher roles can access the plugin’s duplication REST functionality and attempt to create scheduled or private duplicates using a non-publishing account.