CVE-2026-4244

Name of the Vulnerable Software and Affected Versions Post Duplicator versions prior to 3.0.12

Description The Post Duplicator plugin for WordPress allows unauthorized modification of data because the duplicate post() function fails to verify if a user possesses the edit others posts capability. This flaw occurs when the function processes the selectedAuthorId parameter via the duplicate-post REST endpoint. Consequently, authenticated users with Contributor-level access or higher can create duplicated posts attributed to any user, including administrators.

Recommendations Update the plugin to a version newer than 3.0.11. As a temporary mitigation, restrict access to the duplicate-post REST endpoint or limit user permissions to prevent Contributor-level accounts from triggering the duplicate post() function.