CVE-2026-4244: Post Duplicator Plugin Auth Bypass Flaw

CVE-2026-4244 Overview

CVE-2026-4244 is a missing authorization vulnerability [CWE-862] in the Post Duplicator plugin for WordPress. The flaw affects all versions up to and including 3.0.11. The duplicate_post() function does not verify that the calling user has the edit_others_posts capability before accepting a selectedAuthorId parameter through the duplicate-post REST endpoint. Authenticated users with Contributor-level access or higher can duplicate posts and attribute them to any user account, including administrators.

Critical Impact
Contributor-level attackers can create duplicated posts owned by administrators or other privileged users, enabling content spoofing and potential social engineering against site editors.

Affected Products

WordPress Post Duplicator plugin versions up to and including 3.0.11
WordPress sites accepting Contributor-level registrations or with compromised low-privilege accounts
Multi-author WordPress deployments using Post Duplicator for content workflows

Discovery Timeline

2026-08-22 - CVE-2026-4244 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-4244

Vulnerability Analysis

The Post Duplicator plugin exposes a duplicate-post REST endpoint that handles post duplication requests. The endpoint calls the duplicate_post() function defined in includes/api.php, which accepts a selectedAuthorId parameter supplied by the client. The function assigns the specified user ID as the author of the newly duplicated post without checking whether the requesting user holds the edit_others_posts capability.

WordPress uses capability checks to enforce role boundaries. The edit_others_posts capability is normally reserved for Editors and Administrators. Because this capability check is absent, any authenticated user with post creation privileges, including the Contributor role, can bypass the intended authorization boundary. The result is content attribution spoofing across the site.

Root Cause

The root cause is a missing capability check [CWE-862] in the REST route handler. The code path reads selectedAuthorId from the request body and passes it to wp_insert_post() as post_author without calling current_user_can('edit_others_posts'). Relevant code lines have been referenced by the vendor at lines 520, 550, and 728 of includes/api.php.

Attack Vector

An authenticated Contributor sends an authenticated request to the duplicate-post REST endpoint with a selectedAuthorId parameter set to the target user identifier, such as an administrator account. The plugin creates a duplicate post attributed to that user. The attacker can then use the spoofed authorship for phishing lures, malicious content injection under a trusted identity, or workflow abuse in editorial pipelines.

See the WordPress Post Duplicator API source and the Wordfence vulnerability analysis for technical details.

Detection Methods for CVE-2026-4244

Indicators of Compromise

Duplicate posts in the WordPress database where post_author differs from the user who initiated the duplication action in access logs
REST API requests to /wp-json/post-duplicator/* or the duplicate-post route containing a selectedAuthorId parameter from non-Editor accounts
Unexpected draft or pending posts attributed to administrator accounts that those administrators did not create

Detection Strategies

Correlate WordPress wp_posts author IDs against web server access logs to identify mismatches between the authenticated session user and post_author
Alert on REST calls to the Post Duplicator endpoint originating from user sessions that lack the edit_others_posts capability
Review audit logs from WordPress security plugins for post creation events attributed to privileged users during periods those users were inactive

Monitoring Recommendations

Enable request logging on WordPress REST API endpoints and forward logs to a centralized analytics platform for role-versus-action correlation
Monitor for privilege boundary anomalies where low-privilege sessions produce artifacts owned by high-privilege accounts
Track plugin version inventory across WordPress fleets to identify hosts still running Post Duplicator 3.0.11 or earlier

How to Mitigate CVE-2026-4244

Immediate Actions Required

Update the Post Duplicator plugin to a version later than 3.0.11 that includes the fix from WordPress changeset #3485579
Audit existing posts for author attribution anomalies and remove any duplicated content created by Contributor accounts targeting privileged users
Review Contributor and Author role assignments and revoke access for accounts that no longer require post creation privileges

Patch Information

The vendor addressed the issue in WordPress changeset #3485579 by adding a capability check before accepting the selectedAuthorId parameter. Site administrators should upgrade Post Duplicator through the WordPress plugin dashboard or by deploying the patched version through their configuration management pipeline.

Workarounds

Deactivate the Post Duplicator plugin until the patched version is deployed across all WordPress instances
Restrict REST API access to the duplicate-post route at the web server or web application firewall layer for non-Editor sessions
Temporarily downgrade all Contributor accounts to Subscriber pending remediation to eliminate the exploitation prerequisite

bash

# Update Post Duplicator via WP-CLI
wp plugin update post-duplicator
wp plugin get post-duplicator --field=version