CVE-2026-4245: Post Duplicator Plugin Auth Bypass Vulnerability

CVE-2026-4245 Overview

The Post Duplicator plugin for WordPress contains an authorization bypass vulnerability affecting all versions up to and including 3.0.11. The flaw resides in the duplicate_post_permissions() callback, which validates only the duplicate_posts capability. It does not check publish_posts or other status-gated capabilities. Authenticated attackers with Contributor-level access or higher can create duplicate posts with future (scheduled, auto-publishing) or private status, bypassing editorial review. The REST endpoint also fails to enforce administrator-configured post-type duplication restrictions, permitting duplication of post types that administrators have explicitly disabled. The issue is tracked as CWE-863: Incorrect Authorization.

Critical Impact
Contributor-level users can publish scheduled or private content and duplicate restricted post types, bypassing editorial workflow controls.

Affected Products

WordPress Post Duplicator plugin, all versions through 3.0.11
Any WordPress site running Post Duplicator with Contributor-level (or higher) user accounts
WordPress installations relying on administrator-configured post-type duplication restrictions

Discovery Timeline

2026-08-22 - CVE-2026-4245 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-4245

Vulnerability Analysis

The Post Duplicator plugin exposes REST API endpoints that permit authenticated users to clone existing posts. Authorization is enforced through the duplicate_post_permissions() permission callback registered with these endpoints. The callback verifies that the calling user has the duplicate_posts capability but does not evaluate the target post status the caller is requesting.

WordPress differentiates the ability to create drafts from the ability to publish content. Publishing, scheduling (future), and creating private posts require the publish_posts capability, which Contributors do not hold by default. Because the permission callback ignores this distinction, a Contributor can invoke the duplication endpoint and request a future or private status. The resulting post either goes live on schedule or becomes accessible as private content without editor review.

A second flaw exists in the same REST handler. Administrators can configure post types that should be excluded from duplication, but the endpoint does not consult this configuration before executing the clone. Users can therefore duplicate custom post types the administrator has explicitly disallowed.

Root Cause

The root cause is incomplete authorization logic in duplicate_post_permissions() inside includes/api.php. The callback performs a capability check that is coarser than the operation being authorized. It does not correlate the requested post status or post type against WordPress's status-gated capabilities or the plugin's own exclusion settings. See the Post Duplicator source at line 520 and the fix in changeset 3485579.

Attack Vector

Exploitation requires an authenticated account at Contributor level or higher. The attacker sends a crafted request to the plugin's REST duplication endpoint specifying either a future publication date, a private status, or a post type the administrator has excluded from duplication. The endpoint accepts the request, calls wp_insert_post() with the attacker-controlled parameters, and creates the duplicate. No user interaction from an administrator is required. Refer to the Wordfence vulnerability analysis for further technical context.

Detection Methods for CVE-2026-4245

Indicators of Compromise

Posts with future or private status authored by Contributor-level accounts in wp_posts
Unexpected duplicate posts of custom post types that were configured as excluded from duplication
REST API requests to Post Duplicator endpoints originating from low-privilege user sessions
Newly scheduled posts with publication dates set by non-editorial users

Detection Strategies

Query the WordPress database for posts where post_status is future or private and correlate post_author against user roles to identify Contributors publishing scheduled or private content.
Enable WordPress REST API request logging and alert on calls to Post Duplicator routes from users lacking publish_posts.
Compare the plugin's configured excluded post types against recently created duplicates to identify configuration bypasses.

Monitoring Recommendations

Monitor web server access logs for POST requests to /wp-json/ routes exposed by the Post Duplicator plugin.
Track changes in wp_posts for entries created within seconds of each other with identical post_content values.
Alert on privilege-role mismatches where a user without editorial rights authors scheduled or private content.

How to Mitigate CVE-2026-4245

Immediate Actions Required

Update the Post Duplicator plugin to a version above 3.0.11 that includes the fix from changeset 3485579.
Audit existing scheduled and private posts to identify unauthorized content created by Contributor accounts.
Review Contributor and Author accounts for signs of abuse and reset credentials for any suspected compromise.

Patch Information

The vendor addressed the vulnerability in the code committed as WordPress plugin changeset 3485579. The fix extends the duplicate_post_permissions() callback to verify status-gated capabilities such as publish_posts and to enforce the administrator-configured post-type exclusion list before executing duplication.

Workarounds

Temporarily deactivate the Post Duplicator plugin until it is updated to a patched release.
Restrict the duplicate_posts capability so that only Editor and Administrator roles hold it, limiting exposure to trusted accounts.
Place the WordPress REST API behind an authentication proxy or web application firewall rule that blocks Contributor-level access to Post Duplicator endpoints.

bash

# Configuration example: remove the duplicate_posts capability from the Contributor role using WP-CLI
wp cap remove contributor duplicate_posts
wp cap remove author duplicate_posts

# Verify the current capabilities assigned to the Contributor role
wp role list-caps contributor