Executive brief
The Post Duplicator WordPress plugin incorrectly validates user permissions when duplicating posts through its REST API. Attackers with lower-level contributor access can bypass editorial controls to create scheduled or private post copies and duplicate post types that administrators have explicitly disabled from duplication. This undermines content governance and review workflows that newsrooms or organizations rely on.
Technical details
The plugin's `duplicate_post_permissions()` callback verifies only the `duplicate_posts` capability without enforcing required status-gated capabilities such as `publish_posts`. This allows authenticated contributors and above to create post duplicates with sensitive status values (`future`, `private`) that should require higher privileges. Additionally, the REST endpoint does not respect administrator-configured post-type duplication restrictions, allowing users to bypass explicitly disabled post types. An authenticated attacker with Contributor-level access can exploit this via direct REST API calls without user interaction; patches are available in versions 3.0.12 and later.
Affected products
- WordPress Post Duplicator up to 3.0.11
Timeline
- 2026-08-22: disclosed
- 2026: patched: Version 3.0.12 and later contain fixes