CVE-2024-12472 is an authorization bypass vulnerability in the Post Duplicator plugin for WordPress (versions up to 2.36). The vulnerability arises from insufficient access control in the mtphr_duplicate_post() function, which allows authenticated users with Contributor-level permissions or higher to duplicate posts regardless of their visibility settings. This leads to unauthorized exposure of content from password protected, private, or draft posts. The vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 3.1 score is 4.3 (medium severity), reflecting the network attack vector, low complexity, and limited confidentiality impact. No known exploits in the wild have been reported.

Authenticated users with Contributor-level access or above can bypass intended access controls to duplicate and thereby access content from posts that are password protected, private, or in draft status. This results in unauthorized information disclosure. There is no reported impact on integrity or availability. The vulnerability does not require user interaction beyond authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and monitor plugin updates from metaphorcreations for an official patch. Consider disabling or removing the Post Duplicator plugin if unauthorized data exposure is a concern.