WordPress Post Duplicator plugin <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution vulnerability

Missing Authorization to Authenticated Contributor+ Post Duplication with Arbitrary Author Attribution vulnerability discovered by Abi Wiranata in WordPress Plugin Post Duplicator versions = 3.0.11...

CVE-2026-4244

The Post Duplicator plugin for WordPress (all versions up to and including 3.0.11 ) is vulnerable to unauthorized data modification due to a missing capability check in the duplicate_post() function. The function does not verify that the caller holds the edit_others_posts capability before accept...

CVE-2026-4244 Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...