The vulnerability identified as CVE-2026-24387 affects the WP Quick Post Duplicator WordPress plugin by Arul Prasad J. It is characterized by missing authorization checks that allow exploitation of incorrectly configured access control security levels. This issue impacts all versions up to and including 2.1. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is low. No patch or vendor advisory is currently provided, and the plugin is not a cloud service.

An attacker with low privileges can exploit this vulnerability to perform unauthorized actions that affect data integrity within the WP Quick Post Duplicator plugin. There is no impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin access to trusted users only and monitor for unusual activity related to post duplication features. Avoid granting unnecessary privileges to users who can interact with this plugin.