PT-2026-21893 · WordPress · Post Duplicator
Hung Nguyen
·
Publicado
2026-02-25
·
Atualizado
2026-02-25
·
CVE-2026-2301
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Post Duplicator plugin for WordPress versions up to and including 3.0.8
Description
The Post Duplicator plugin for WordPress is susceptible to unauthorized modification of protected post meta data. This occurs because the
duplicate post() function utilizes $wpdb->insert() directly into the wp postmeta table, bypassing the standard add post meta() function and its associated is protected meta() check. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary protected meta keys, such as wp page template and wp attached file, on duplicated posts. The issue is exploitable through the customMetaData JSON array parameter in the /wp-json/post-duplicator/v1/duplicate-post API endpoint.Recommendations
Update the Post Duplicator plugin to a version later than 3.0.8.
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Post Duplicator