CVE-2026-4245 metaphorcreations CVE debrief

Who should care

Defenders responsible for WordPress installations with the Post Duplicator plugin should assess exposure and verify the presence of this vulnerability. Editorial teams and administrators configuring post duplication restrictions should also be aware of this issue.

Why it matters

The Post Duplicator plugin for WordPress has an authorization bypass vulnerability that allows authenticated attackers to create duplicate posts with 'future' or 'private' status, bypassing editorial review. Defenders should verify the presence of this vulnerability and restrict post duplication to authorized users.

• Authenticated attackers with Contributor-level access and above can create duplicate posts with 'future' or 'private' status, bypassing editorial review.
• The REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly disabled.
• Defenders need to verify the presence of this vulnerability in their WordPress installations and restrict post duplication to authorized users.
• Remediation priority is high for WordPress installations with the Post Duplicator plugin, especially those with multiple contributors or editors.

Technical summary

The Post Duplicator plugin for WordPress is vulnerable to authorization bypass due to insufficient permission checks in the `duplicate_post_permissions()` callback. This allows authenticated attackers with Contributor-level access and above to create duplicate posts with 'future' or 'private' status, bypassing editorial review. The REST endpoint also fails to enforce administrator-configured post-type duplication restrictions.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and restrict post duplication to authorized users.

Recommended defensive actions

• Verify the presence of the Post Duplicator plugin in your WordPress installation and check if the version is 3.0.11 or earlier.
• Restrict post duplication to authorized users and ensure that Contributor-level access and above does not allow bypassing editorial review.
• Review and enforce administrator-configured post-type duplication restrictions to prevent duplication of disabled post types.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. However, the exact scope of affected versions and potential impact require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.