The Fast Page & Post Duplicator plugin for WordPress suffers from an authorization bypass vulnerability (CWE-639) due to insufficient validation of a user-controlled key in the 'content_clone' function. This allows authenticated users with Author-level privileges or above to perform unauthorized cloning and reading of private posts. The vulnerability is present in all versions up to 6.0. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring privileges, no user interaction, and limited confidentiality impact. No patch or vendor advisory is currently provided.

An attacker with Author-level or higher privileges can bypass authorization controls to clone and access private posts that should otherwise be restricted. This leads to unauthorized disclosure of potentially sensitive content. The vulnerability does not affect integrity or availability. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and monitor for suspicious activity related to cloning operations within the plugin. Avoid granting unnecessary privileges to users. Follow updates from the plugin vendor for official patches.