CVE-2026-4245 describes an authorization bypass in the Post Duplicator plugin for WordPress. The vulnerability arises because the permission callback `duplicate_post_permissions()` only checks for the `duplicate_posts` capability, without verifying if the user has higher-level capabilities such as `publish_posts`. This allows authenticated users with Contributor-level access or above to create duplicate posts with statuses like `future` (scheduled) or `private`, circumventing editorial controls. Additionally, the REST API endpoint does not enforce administrator-configured restrictions on post-type duplication, enabling duplication of post types that should be disabled.

An attacker with Contributor-level or higher access can bypass editorial review processes by duplicating posts with scheduled or private status. This could lead to unauthorized content publication or exposure of private content. The failure to enforce post-type duplication restrictions may allow duplication of sensitive or restricted content types.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level user permissions where possible and monitor for unauthorized post duplications. Review and adjust user capabilities to limit duplication actions.