PT-2026-21893 · WordPress · Post Duplicator

Hung Nguyen · Published 2026-02-25 · Updated 2026-02-25 · CVE-2026-2301

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Post Duplicator plugin for WordPress versions up to and including 3.0.8

Description The Post Duplicator plugin for WordPress is susceptible to unauthorized modification of protected post meta data. This occurs because the duplicate post() function utilizes $wpdb->insert() directly into the wp postmeta table, bypassing the standard add post meta() function and its associated is protected meta() check. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary protected meta keys, such as wp page template and wp attached file, on duplicated posts. The issue is exploitable through the customMetaData JSON array parameter in the /wp-json/post-duplicator/v1/duplicate-post API endpoint.

Recommendations Update the Post Duplicator plugin to a version later than 3.0.8.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2301

Affected Products

Post Duplicator

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-2301 · Security Note
• https://plugins.trac.wordpress.org/browser/post-duplicator/tags/3.0.6/includes/api.php#L843 · Note
• https://t.me/cveNotify/153132 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e5c86f72-934c-4f3b-ab2a-65df1490ca8a?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3463768%40post-duplicator%2Ftrunk&old=3459096%40post-duplicator%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/post-duplicator/tags/3.0.6/includes/api.php#L923 · Note
• https://twitter.com/CVEnew/status/2026641314834464960 · Twitter Post
• https://t.me/CVEtracker/45719 · Telegram Post