Executive brief
Post Duplicator is a WordPress plugin that allows users to create copies of existing posts. Due to a missing security check, authenticated users with basic contributor-level access can exploit the plugin's REST API to create duplicate posts attributed to any user, including administrators. This could allow an attacker to impersonate higher-privileged accounts or inject malicious content under an admin's name.
Technical details
The vulnerability is a privilege escalation flaw stemming from an insufficient capability check in the `duplicate_post()` function exposed via the `duplicate-post` REST endpoint. The function fails to verify that the caller possesses the `edit_others_posts` capability before accepting the `selectedAuthorId` parameter, allowing authenticated attackers with Contributor-level privileges (or above) to forge post authorship. The attack requires authentication to the WordPress instance; no network-level bypass is required. Exploitation enables attackers to create posts attributed to arbitrary users, including administrators, potentially facilitating social engineering, content manipulation, or account impersonation. A fix that validates the required capability before processing the author ID parameter should be available in a patched version.
Affected products
- Post Duplicator Post Duplicator up to and including 3.0.11
Timeline
- 2026-08-22: disclosed