The Post Duplicator plugin for WordPress has a vulnerability allowing unauthorized modification of data due to a missing capability check on the `duplicate_post()` function. This issue affects all versions up to, and including, 3.0.11. The vulnerability allows authenticated attackers with Contributor-level access and above to create duplicated posts attributed to any user, including administrators. This c [truncated]
The Post Duplicator plugin for WordPress has an authorization bypass vulnerability in all versions up to, and including, 3.0.11. This allows authenticated attackers with Contributor-level access and above to create duplicate posts with 'future' (scheduled, auto-publishes) or 'private' status, bypassing editorial review. The REST endpoint also does not enforce administrator-configured post-type duplication [truncated]
CVE-2026-27355 is a MEDIUM-severity vulnerability in Ditty plugin versions <= 3.1.66, allowing unauthenticated broken access control. The CVE record was published on 2026-07-23T12:17:17.770Z and has not been modified since then.
CVE-2026-39474 is a HIGH severity vulnerability (CVSS Score: 8.8) affecting Post Duplicator plugin versions <= 3.0.10. The vulnerability allows for Contributor PHP Object Injection. The CVE was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-39474) and last modified on [cveModifiedAt](https://nvd.nist.gov/vuln/detail/CVE-2026-39474).
