CVE-2026-2301 Overview
The Post Duplicator plugin for WordPress contains an authorization flaw allowing unauthorized arbitrary protected post meta insertion. The vulnerability affects all versions up to and including 3.0.8. The duplicate_post() function in includes/api.php calls $wpdb->insert() directly against the wp_postmeta table instead of using WordPress's add_post_meta() API. This bypasses the is_protected_meta() check that normally blocks lower-privileged users from setting protected meta keys prefixed with _. Authenticated attackers with Contributor-level access can inject sensitive keys such as _wp_page_template and _wp_attached_file through the /wp-json/post-duplicator/v1/duplicate-post REST endpoint. The flaw is classified as Missing Authorization [CWE-862].
Critical Impact
Contributor-level attackers can inject protected post meta keys on duplicated posts, modifying page templates and attachment metadata outside their privilege scope.
Affected Products
- WordPress Post Duplicator plugin versions up to and including 3.0.8
- WordPress sites with Contributor-level (or higher) user registration enabled
- WordPress installations exposing the /wp-json/post-duplicator/v1/duplicate-post REST API endpoint
Discovery Timeline
- 2026-02-25 - CVE CVE-2026-2301 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2026-2301
Vulnerability Analysis
The vulnerability is a Missing Authorization issue in the Post Duplicator REST API. When a user duplicates a post, the plugin accepts a customMetaData JSON array parameter and writes each entry to the wp_postmeta database table. The plugin uses $wpdb->insert() for the database operation, which performs raw SQL insertion without invoking WordPress's meta key validation logic. As a result, no check is performed to determine whether the supplied meta key is protected. Attackers with Contributor permissions can therefore set meta keys reserved for higher-privileged operations, such as _wp_page_template to alter rendering or _wp_attached_file to manipulate media references.
Root Cause
The root cause is the direct use of $wpdb->insert() on the wp_postmeta table within the duplicate_post() function in includes/api.php. WordPress's add_post_meta() function would invoke is_protected_meta() and reject meta keys beginning with an underscore for users lacking the edit_post_meta capability for that key. By bypassing this API layer, the plugin removes the privilege boundary that WordPress enforces for protected meta. Review of the affected code is available at the WordPress Post Duplicator source.
Attack Vector
An authenticated attacker with Contributor-level access sends a POST request to /wp-json/post-duplicator/v1/duplicate-post. The request body includes a customMetaData JSON array containing arbitrary meta key/value pairs, including protected keys prefixed with _. The plugin writes these entries directly into wp_postmeta for the duplicated post. The attacker controls protected metadata on a post they own, which can influence template selection, attachment references, and other server-side behaviors gated on post meta. No user interaction is required beyond the attacker's own authenticated session.
Details of the security fix are documented in the WordPress Changeset Update and the Wordfence Vulnerability Analysis.
Detection Methods for CVE-2026-2301
Indicators of Compromise
- POST requests to /wp-json/post-duplicator/v1/duplicate-post from accounts holding only Contributor or Author roles.
- Request bodies containing a customMetaData array with meta keys starting with _, such as _wp_page_template or _wp_attached_file.
- New wp_postmeta rows on duplicated posts with protected meta keys not previously associated with that author.
Detection Strategies
- Inspect web server access logs for calls to the Post Duplicator REST route originating from low-privileged authenticated users.
- Query wp_postmeta for protected meta keys on posts owned by Contributor-level users and correlate with post duplication events.
- Compare the installed Post Duplicator plugin version against the patched release in WordPress plugin inventory scans.
Monitoring Recommendations
- Enable WordPress REST API request logging and forward events to a centralized log platform for review.
- Alert on unexpected modifications to _wp_page_template or attachment-related meta keys by non-Editor accounts.
- Track plugin version drift on managed WordPress fleets and flag installations still running Post Duplicator 3.0.8 or earlier.
How to Mitigate CVE-2026-2301
Immediate Actions Required
- Update the Post Duplicator plugin to a version newer than 3.0.8 that incorporates the upstream fix.
- Audit existing Contributor and Author accounts and remove any that are unused or untrusted.
- Review wp_postmeta entries on posts created or duplicated by low-privileged users for unexpected protected meta keys.
Patch Information
The vendor addressed the issue in the changeset that replaces the direct $wpdb->insert() call with WordPress's standard meta API, restoring the is_protected_meta() check. Refer to the WordPress Changeset Update for the code change and update the plugin through the WordPress dashboard.
Workarounds
- Deactivate the Post Duplicator plugin until the patched version can be applied.
- Restrict access to the /wp-json/post-duplicator/v1/duplicate-post endpoint at the web application firewall layer for non-Editor roles.
- Limit Contributor-level account provisioning and require manual review for post duplication actions where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
