{"id":"CVE-2026-4245","aliases":["EUVD-2026-64251","GHSA-53vg-j9w4-c9v9"],"status":"published","title":"Post Duplicator \u003c= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication","description":"The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the `duplicate_post_permissions()` permission callback only verifying the `duplicate_posts` capability without checking whether the requesting user holds `publish_posts` or other status-gated capabilities. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicate posts with `future` (scheduled, auto-publishes) or `private` status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly disabled.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00385,"percentile":0.3285,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2026-08-22T11:30:40Z","modified":"2026-10-12T16:10:00Z","products":[{"vendor":"metaphor creations","product":"post duplicator"},{"vendor":"metaphorcreations","product":"post duplicator"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb671c8f-9e14-4f79-adfa-72f48ec02449?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/post-duplicator/trunk/includes/api.php#L520"},{"url":"https://plugins.trac.wordpress.org/browser/post-duplicator/trunk/includes/api.php#L635"},{"url":"https://plugins.trac.wordpress.org/browser/post-duplicator/trunk/includes/api.php#L740"},{"url":"https://plugins.trac.wordpress.org/browser/post-duplicator/trunk/includes/api.php#L624"},{"url":"https://plugins.trac.wordpress.org/changeset/3485579/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4245"},{"url":"https://plugins.trac.wordpress.org/changeset/3485579"},{"url":"https://github.com/advisories/GHSA-53vg-j9w4-c9v9"}],"sources":{"cve":[{"id":"CVE-2026-4245","title":"Post Duplicator \u003c= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication","description":"The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the `duplicate_post_permissions()` permission callback only verifying the `duplicate_posts` capability without checking whether the requesting user holds `publish_posts` or other status-gated capabilities. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicate posts with `future` (scheduled, auto-publishes) or `private` status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly disabled.","status":"published","published":"2026-08-22T11:30:40.062Z","modified":"2026-08-24T20:01:34.6Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-64251","description":"The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the `duplicate_post_permissions()` permission callback only verifying the `duplicate_posts` capability without checking whether the requesting user holds `publish_posts` or other status-gated capabilities. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicate posts with `future` (scheduled, auto-publishes) or `private` status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly disabled.","status":"published","published":"2026-08-22T11:30:40Z","modified":"2026-08-24T20:01:34Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:34.230875Z"}],"ghsa":[{"id":"GHSA-53vg-j9w4-c9v9","title":"The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up...","description":"The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the `duplicate_post_permissions()` permission callback only verifying the `duplicate_posts` capability without checking whether the requesting user holds `publish_posts` or other status-gated capabilities. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicate posts with `future` (scheduled, auto-publishes) or `private` status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly disabled.","status":"published","published":"2026-08-22T12:30:25Z","modified":"2026-08-22T12:30:34Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:10:50.919771Z"}],"nvd":[{"id":"CVE-2026-4245","description":"The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the `duplicate_post_permissions()` permission callback only verifying the `duplicate_posts` capability without checking whether the requesting user holds `publish_posts` or other status-gated capabilities. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicate posts with `future` (scheduled, auto-publishes) or `private` status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly disabled.","status":"published","published":"2026-08-22T12:16:25.4Z","modified":"2026-10-12T16:10:00.22Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:40.665005Z"}]}}