CVE-2026-2301

creationtimestamp| type| source ---|---|--- 2026-02-25 13:13:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfor42twbi2n...

CVE-2026-2301 Post Duplicator <= 3.0.8 - Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via 'customMetaData' Parameter

The Post Duplicator plugin for WordPress is vulnerable to unauthorized arbitrary protected post meta insertion in all versions up to, and including, 3.0.8. This is due to the duplicatepost function in includes/api.php using $wpdb-insert directly to the wppostmeta table instead of WordPress's...