CVE-2026-4244— Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution
Quick assessment
Affected
metaphorcreations Post Duplicator
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 Post Duplicator 插件存在漏洞，导致在版本 3.0.11 及更早版本中，由于 函数缺少权限检查，允许未经授权的数据修改。该函数在接受通过 REST 端点传入的 参数时，并未验证用户是否具备 能力。这使得具有贡献者及以上级别的已认证攻击者能够创建以任意用户（包括管理员）名义发布的重复帖子。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| metaphorcreations | Post Duplicator | ≤ 3.0.11 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-4244
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution
Source: CVE Program / CVE List V5
Vulnerability Description
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `duplicate_post()` function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has `edit_others_posts` capability before accepting a `selectedAuthorId` parameter via the `duplicate-post` REST endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicated posts attributed to any user, including administrators.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| metaphorcreations | Post Duplicator | 0 ~ 3.0.11 | - |
|
II. Public POCs for CVE-2026-4244
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-4244
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-4244 (1)
News Coverage for CVE-2026-4244 (1)
IV. Related Vulnerabilities
Same product: Post Duplicator
-
CVE-2026-4245
Post Duplicator <= 3.0.11 - Authorization Bypass to Authenti -
CVE-2026-10749
Post Duplicator < 3.0.15 - Contributor+ PHP Object Injection -
CVE-2026-39474
WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Inje -
CVE-2026-2301
Post Duplicator <= 3.0.8 - Missing Authorization to Authenti -
CVE-2025-24736
WordPress Post Duplicator plugin <= 2.35 - Broken Access Con
Same vendor: metaphorcreations
-
CVE-2026-4245
Post Duplicator <= 3.0.11 - Authorization Bypass to Authenti -
CVE-2026-27355
WordPress Ditty plugin <= 3.1.66 - Broken Access Control vul -
CVE-2026-39474
WordPress Post Duplicator plugin <= 3.0.10 - PHP Object Inje -
CVE-2026-9011
Ditty <= 3.1.65 - Missing Authorization to Unauthenticated S -
CVE-2026-2301
Post Duplicator <= 3.0.8 - Missing Authorization to Authenti
Same weakness: CWE-862
-
CVE-2026-19200
Velociraptor Analyst overwrites live built-in artifacts thro -
CVE-2026-78204
Ghostwriter through 7.2.6 Missing Authorization on Report Te -
CVE-2026-75866
Punk::OAuth2::Server versions through 0.03 for Perl issue ac -
CVE-2026-5093
Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Se -
CVE-2026-12710
Missing Authorization in Application Integration QueryEngine
V. Comments for CVE-2026-4244
No comments yet