CVE-2026-4244 metaphorcreations CVE debrief

Who should care

WordPress site administrators, security teams, and users with Contributor-level access and above should assess exposure and take necessary actions to prevent unauthorized modifications.

Why it matters

The Post Duplicator plugin for WordPress has a medium-severity vulnerability allowing unauthorized modification of data. WordPress site administrators and security teams should assess exposure and apply necessary updates or mitigations to prevent potential content integrity issues and unauthorized post creation.

• Potential for unauthorized creation of duplicated posts attributed to any user, including administrators.
• Possible impact on content integrity and authenticity.
• Need for verification of user roles and capabilities to prevent exploitation.
• Requirement for timely application of updates or patches to the Post Duplicator plugin.

Technical summary

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `duplicate_post()` function in all versions up to, and including, 3.0.11. This allows authenticated attackers with Contributor-level access and above to create duplicated posts attributed to any user, including administrators. The issue arises from the `duplicate_post()` function not verifying the `edit_others_posts` capability before accepting a `selectedAuthorId` parameter via the `duplicate-post` REST endpoint. This could lead to potential content integrity issues and unauthorized post creation if not addressed.

Defensive priority

Medium priority for WordPress site administrators and security teams to assess exposure and apply necessary updates or mitigations.

Recommended defensive actions

• Assess exposure by checking if the Post Duplicator plugin version is within the affected range (up to 3.0.11).
• Verify that user roles and capabilities are properly configured to prevent unauthorized modifications.
• Apply necessary updates or patches to the Post Duplicator plugin.
• Monitor for suspicious activity related to post duplication.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by the `duplicate_post()` function not verifying the `edit_others_posts` capability before accepting a `selectedAuthorId` parameter via the `duplicate-post` REST endpoint. This allows authenticated attackers with Contributor-level access and above to create duplicated posts attributed to any user, including administrators.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.