Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-10
Post Duplicator - Security Vulnerability (CVE-2026-121875)
The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin.
PLUGIN
Post Duplicator
CVE-2026-121875
Risk Score
Threat Entry
Updated 2026-11-10
Post Duplicator - Security Vulnerability (CVE-2026-121874)
The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities.
PLUGIN
Post Duplicator
CVE-2026-121874
Risk Score
Threat Entry
Updated 2026-11-04
Post Duplicator - Security Vulnerability (CVE-2026-111740)
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.
PLUGIN
Post Duplicator
CVE-2026-111740
Risk Score
Threat Entry
Updated 2026-10-12
Post Duplicator - Broken Access Control (CVE-2026-4244)
The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `duplicate_post()` function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has `edit_others_posts` capability before accepting a `selectedAuthorId` parameter via the `duplicate-post` REST endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicated posts attributed to any user, including administrators.
PLUGIN
Post Duplicator
CVE-2026-4244
Risk Score
Threat Entry
Updated 2026-10-12
Post Duplicator - Broken Access Control (CVE-2026-4245)
The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the `duplicate_post_permissions()` permission callback only verifying the `duplicate_posts` capability without checking whether the requesting user holds `publish_posts` or other status-gated capabilities. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicate posts with `future` (scheduled, auto-publishes) or `private` status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly…
PLUGIN
Post Duplicator
CVE-2026-4245
Risk Score
Threat Entry
Updated 2026-06-25
Post Duplicator - Security Vulnerability (CVE-2026-10749)
The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplied serialized values without the WordPress meta API's double-serialization protection, allowing users with Contributor-level access and above to inject a PHP Object.
PLUGIN
Post Duplicator
CVE-2026-10749
Risk Score
Threat Entry
Updated 2026-06-17
Post Duplicator - PHP Object Injection (CVE-2026-39474)
Contributor PHP Object Injection in Post Duplicator
PLUGIN
Post Duplicator
CVE-2026-39474
Risk Score
Threat Entry
Updated 2026-06-17
Post Duplicator - Security Vulnerability (CVE-2026-2301)
The Post Duplicator plugin for WordPress is vulnerable to unauthorized arbitrary protected post meta insertion in all versions up to, and including, 3.0.8. This is due to the `duplicate_post()` function in `includes/api.php` using `$wpdb->insert()` directly to the `wp_postmeta` table instead of WordPress's standard `add_post_meta()` function, which would call `is_protected_meta()` to prevent lower-privileged users from setting protected meta keys (those starting with `_`). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary protected post meta keys such as `_wp_page_template`, `_wp_attached_file`, and other sensitive meta keys…
PLUGIN
Post Duplicator
CVE-2026-2301
Risk Score
Threat Entry
Updated 2026-06-17
Post Duplicator - Broken Access Control (CVE-2025-24736)
Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through
PLUGIN
Post Duplicator
CVE-2025-24736
Risk Score
Threat Entry
Updated 2026-06-17
Post Duplicator - Information Disclosure (CVE-2024-12472)
The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_duplicate_post() function due to insufficient restrictions on which posts can be duplicated. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to by duplicating the post.
PLUGIN
Post Duplicator
CVE-2024-12472
Risk Score
Threat Entry
Updated 2026-06-17
Post Duplicator - Broken Access Control (CVE-2023-49835)
Missing Authorization vulnerability in Metaphor Creations Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through 2.31.
PLUGIN
Post Duplicator
CVE-2023-49835
Risk Score
Threat Entry
Updated 2026-06-17
Post Duplicator - Cross-Site Scripting (XSS) (CVE-2016-15027)
A vulnerability was found in meta4creations Post Duplicator Plugin 2.18 on WordPress. It has been classified as problematic. Affected is the function mtphr_post_duplicator_notice of the file includes/notices.php. The manipulation of the argument post-duplicated leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.19 is able to address this issue. The name of the patch is ca67c05e490c0cf93a1e9b2d93bfeff3dd96f594. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221496.
PLUGIN
Post Duplicator
CVE-2016-15027
Risk Score
Threat Entry
Updated 2026-06-17
Post Duplicator - Cross-Site Scripting (XSS) (CVE-2021-33852)
A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Duplicate Title" text box executes whenever the user opens the Settings Page of the Post Duplicator Plugin or the application root page after duplicating any of the existing posts.
PLUGIN
Post Duplicator
CVE-2021-33852
Risk Score