CVE-2026-4245: CWE-863 Incorrect Authorization in metaphorcreations Post Duplicator

CVE-2026-4245 is an authorization bypass vulnerability in the metaphorcreations Post Duplicator WordPress plugin affecting versions up to 3.0.11. The vulnerability arises because the permission callback `duplicate_post_permissions()` only checks for the `duplicate_posts` capability and does not verify if the user has `publish_posts` or other status-gated capabilities. This allows authenticated users with Contributor-level privileges or above to create duplicate posts with scheduled (future) or private status, circumventing editorial controls. Additionally, the REST API endpoint does not enforce administrator-configured restrictions on post-type duplication, enabling duplication of post types that should be disabled.

Authenticated users with Contributor-level access or higher can bypass editorial review by duplicating posts with future or private status. This could lead to unauthorized content being scheduled for publication or kept private without proper oversight. The failure to enforce post-type duplication restrictions may also allow duplication of disallowed post types, potentially violating site policies or configurations.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level user permissions where possible and monitor for unauthorized duplication activities. Avoid granting the `duplicate_posts` capability to users who should not duplicate posts with elevated statuses.