CVE-2026-4244 is a missing authorization vulnerability (CWE-862) in the Post Duplicator WordPress plugin by metaphorcreations. The duplicate_post() function does not verify that the user has the 'edit_others_posts' capability before accepting the 'selectedAuthorId' parameter via the 'duplicate-post' REST endpoint. This allows authenticated users with Contributor-level permissions or higher to create duplicated posts attributed to any user, including administrators. The issue affects all versions up to and including 3.0.11. No official patch or remediation level has been confirmed as of the published date.

An attacker with Contributor-level access or higher can exploit this vulnerability to duplicate posts and assign them to arbitrary users, including administrators. This unauthorized modification of post attribution could lead to confusion, privilege escalation attempts, or misuse of administrative privileges indirectly. There is no indication of direct confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level user permissions where possible and monitor for suspicious post duplications. Avoid granting unnecessary permissions to users. Follow updates from metaphorcreations for official patches or workarounds.