CVE-2026-2301: WordPress Post Duplicator Auth Bypass Flaw

CVE-2026-2301 Overview

The Post Duplicator plugin for WordPress contains an authorization bypass vulnerability that allows authenticated attackers to inject arbitrary protected post meta keys. This vulnerability exists in all versions up to and including 3.0.8 due to improper use of database functions in the duplicate_post() function located in includes/api.php. The vulnerable code uses $wpdb->insert() directly to write to the wp_postmeta table instead of WordPress's standard add_post_meta() function, which would normally call is_protected_meta() to prevent lower-privileged users from setting protected meta keys (those starting with _).

Critical Impact

Authenticated attackers with Contributor-level access or above can inject arbitrary protected post meta keys such as _wp_page_template, _wp_attached_file, and other sensitive meta keys on duplicated posts, potentially leading to template manipulation and unauthorized content modifications.

Affected Products

• Post Duplicator plugin for WordPress versions up to and including 3.0.8

Discovery Timeline

• February 25, 2026 - CVE-2026-2301 published to NVD
• February 25, 2026 - Last updated in NVD database

Technical Details for CVE-2026-2301

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization). The core issue stems from a design flaw in how the Post Duplicator plugin handles post meta data during the duplication process. WordPress provides the add_post_meta() function as a secure wrapper for inserting post meta data, which includes built-in authorization checks through is_protected_meta(). This function specifically prevents users without appropriate privileges from modifying meta keys prefixed with an underscore (_), which are reserved for internal WordPress use and plugin configurations.

The vulnerable duplicate_post() function bypasses this security mechanism entirely by using the raw $wpdb->insert() method to directly write data to the wp_postmeta database table. This architectural shortcut eliminates the authorization layer that WordPress provides, allowing users with minimal privileges (Contributor-level) to manipulate protected meta fields that should be restricted to administrators.

Root Cause

The root cause is the improper use of direct database insertion via $wpdb->insert() in the duplicate_post() function within includes/api.php. The vulnerable code paths are located at lines 843 and 923 of the plugin's API file. By circumventing WordPress's add_post_meta() function, the plugin fails to invoke the is_protected_meta() check that would normally prevent unauthorized access to protected meta keys.

Attack Vector

An authenticated attacker with at least Contributor-level access can exploit this vulnerability by sending a crafted request to the /wp-json/post-duplicator/v1/duplicate-post REST API endpoint. The attacker includes a malicious customMetaData JSON array parameter containing protected meta keys such as _wp_page_template, _wp_attached_file, or other sensitive internal meta keys. When the post is duplicated, these protected values are written directly to the database without authorization checks, allowing the attacker to manipulate template assignments, file associations, and other critical WordPress internal configurations.

Detection Methods for CVE-2026-2301

Indicators of Compromise

• Unexpected changes to post meta values prefixed with _ (underscore) in the wp_postmeta table
• Unusual REST API requests to /wp-json/post-duplicator/v1/duplicate-post endpoint containing customMetaData parameters
• Modified _wp_page_template values on posts that should not have custom templates assigned
• Contributor or Author users creating posts with protected meta configurations

Detection Strategies

• Monitor WordPress REST API logs for requests to the /wp-json/post-duplicator/v1/duplicate-post endpoint with customMetaData parameters containing underscore-prefixed keys
• Implement database query logging to detect direct insertions to wp_postmeta table involving protected meta keys from non-administrator sessions
• Deploy a Web Application Firewall (WAF) rule to inspect and alert on suspicious POST requests to the duplicate-post endpoint

Monitoring Recommendations

• Enable WordPress debug logging and review for unusual post duplication activity
• Configure SentinelOne Singularity to monitor file system changes in the WordPress installation directory, particularly template-related modifications
• Audit user activity logs for Contributor and Author accounts performing excessive post duplication operations

How to Mitigate CVE-2026-2301

Immediate Actions Required

• Update the Post Duplicator plugin to a version newer than 3.0.8 immediately
• Review recent post duplication activity in WordPress logs for signs of exploitation
• Audit the wp_postmeta table for unauthorized protected meta key modifications
• Temporarily disable the Post Duplicator plugin if an update is not immediately available

Patch Information

The vulnerability has been addressed by the plugin developers. The fix can be reviewed in the WordPress Post Duplicator Changeset. Users should update to the latest version available through the WordPress plugin repository. Additional technical analysis is available from Wordfence.

Workarounds

• Restrict the Post Duplicator plugin functionality to Administrator users only until a patch can be applied
• Use a security plugin to block REST API access to the vulnerable endpoint for non-administrator users
• Implement server-level access controls to restrict access to /wp-json/post-duplicator/v1/duplicate-post

# Apache .htaccess rule to restrict the vulnerable endpoint
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-json/post-duplicator/v1/duplicate-post
    RewriteRule .* - [F,L]
</IfModule>