Executive brief
The Post Duplicator plugin for WordPress, which allows users to easily clone posts and pages, contains a security flaw in how it handles custom data during the duplication process. An attacker with a low-level 'Contributor' account can exploit this to inject malicious code into the website's database. If successful, this could allow the attacker to take full control of the site, steal sensitive information, or delete files, depending on other software installed on the server.
Technical details
The Post Duplicator plugin fails to use the WordPress meta API's double-serialization protection when storing custom meta-data during post duplication. Specifically, the `duplicate-post` REST API endpoint allows users with Contributor-level access or higher to provide raw serialized PHP strings via the `customMetaData` parameter. Because the plugin stores these values directly without re-serialization, subsequent calls to `get_post_meta()` trigger WordPress's `maybe_unserialize()` function, leading to PHP Object Injection. If a suitable POP (Property-Oriented Programming) chain exists within the site's active themes or plugins, an attacker can achieve remote code execution (RCE), perform arbitrary file operations, or disclose sensitive data. This issue is fixed in version 3.0.15.
Affected products
- Metaphor Creations Post Duplicator < 3.0.15
Timeline
- 2026-06-03: disclosed: Publicly published by WPScan
- 2026-06-15: patched: Fixed in version 3.0.15
- 2026-06-24: advisory: CVE published to NVD