The Galaxy Weblinks WP Clone any post type plugin does not perform proper authorization checks when executing its clone feature, allowing an attacker to duplicate any post type. The vulnerability is classified as CWE-862, indicating a failure to enforce correct permissions. Based on the description, it is inferred that an attacker must be authenticated with a role that has access to the plugin’s interface, but does not need elevated administrator privileges to exploit the flaw.

All installations of the WP Clone any post type plugin at versions 3.6 or earlier are affected, regardless of the specific patch level or WordPress configuration. Sites that have not applied the official fix are at risk of having their content unintentionally duplicated or exposed.

The CVSS score of 5.3 places the vulnerability in the moderate range. The EPSS score of less than 1% suggests that exploitation activity is currently low and no public exploit code has been observed. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by accessing the plugin’s clone functionality as a user with sufficient privileges to reach the interface; based on the description, it is inferred that any authenticated user who can call the cloning endpoint may succeed.