CVE-2026-4245
Received Received - Intake

Post Duplicator Plugin Authorization Bypass Vulnerability

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: Wordfence

Description
The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the `duplicate_post_permissions()` permission callback only verifying the `duplicate_posts` capability without checking whether the requesting user holds `publish_posts` or other status-gated capabilities. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicate posts with `future` (scheduled, auto-publishes) or `private` status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly disabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-4245
EUVD
EUVD-2026-64251

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpengine post_duplicator to 3.0.11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Post Duplicator WordPress plugin up to version 3.0.11 has an authorization bypass flaw. The plugin's permission check only verifies if a user has the 'duplicate_posts' capability but fails to confirm if they also hold 'publish_posts' or other required capabilities. This allows authenticated users with Contributor-level access or higher to create duplicate posts with future or private status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured restrictions on duplicating disabled post types.

Detection Guidance

Check WordPress plugins for Post Duplicator versions up to 3.0.11. Review user roles with Contributor access or higher for unauthorized post duplication. Inspect REST API logs for duplicate post creation requests.

Impact Analysis

Authenticated attackers with Contributor-level access or above could create duplicate posts with future or private status, bypassing normal editorial controls. This could lead to unauthorized content publication, disclosure of private posts, or disruption of scheduled content. The lack of post-type duplication restrictions may also allow duplication of restricted post types.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of private or sensitive content if attackers create duplicate private posts. This may violate data protection requirements under GDPR or HIPAA, depending on the content involved. Unauthorized publication of future posts could also result in premature disclosure of sensitive information.

Mitigation Strategies

Update Post Duplicator plugin to the latest version. Remove Contributor-level access if not required. Review and restrict post duplication settings in plugin configuration. Monitor for unauthorized post status changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4245. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart