The vulnerability in the Post Cloner plugin is a missing authorization check that allows any site visitor to invoke the plugin’s post‑cloning capability without appropriate permissions. This is a CWE-862 Missing Authorization flaw. An attacker could therefore clone existing content or create duplicate posts, potentially injecting misleading or malicious content into the site’s public‑facing areas. This flaw does not provide direct code execution, but it enables unauthorized modification of website content, undermining content integrity and potentially facilitating social engineering or defacement.

The affected product is the WordPress plugin developed by Evan Herman named Post Cloner. All released versions up to and including 1.0.0 are impacted.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% suggests that the likelihood of real‑world exploitation is low. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to access the website’s frontend or an authenticated user’s interface to trigger the plugin’s cloning function; the likely attack vector is a network‑based interaction with the WordPress site and is inferred from the nature of the plugin functionality.