The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities that administrators assign to roles through its permission settings. Because of this oversight a site administrator on a multisite network who is not a Super Admin can grant any role arbitrary capabilities, including the network‑management capabilities that should be restricted to Super Admins. The result is an escalation of privileges that allows the attacker to perform any network‑wide operation, effectively turning a non‑super‑admin into a Super Admin.

The affected product is the Post Duplicator plugin for WordPress, specifically all releases prior to version 3.0.18. The plugin is distributed under the Unknown:Post Duplicator vendor, and no additional version details beyond the “<3.0.18” range are included. Admin‑level users on a multisite installation without super‑admin rights are the primary group that could exploit the flaw.

The lack of capability validation is a classic example of improper access control, contributing to CWE‑284. Although no CVSS score is available and the EPSS metric is not published, the vulnerability is trivially exploitable once an actor has administrator privileges on the site. A successful exploitation would give the attacker unrestricted control over the multisite network, allowing changes to settings, installation of additional plugins, or direct access to protected content. Because the flaw exists in the plugin code, it can be abused by any user who can edit the plugin’s permission interface, making the risk significant in the absence of a patch.