The Post Duplicator plugin for WordPress contains a flaw that permits authenticated users with Contributor permissions or higher to insert arbitrary protected post meta keys. The flaw arises because the duplicate_post() function writes directly to the wp_postmeta table with a raw SQL insert, bypassing WordPress’s add_post_meta() routine which normally protects keys that begin with an underscore. Attackers can therefore supply a customMetaData JSON array via the /wp-json/post-duplicator/v1/duplicate-post REST endpoint and create entries such as _wp_page_template, _wp_attached_file, and other sensitive meta fields on duplicated posts. This grants the malicious actor the ability to modify core post metadata that is normally restricted to administrators. The weakness is classified as CWE‑862: Missing Authorization.

WordPress installations that run Post Duplicator up to and including version 3.0.8, a plugin supplied by metaphorcreations. Any site using these versions is susceptible, regardless of the WordPress core version, as the vector is the plugin’s REST API endpoint.

The CVSS score of 4.3 indicates a moderate severity vulnerability with limited impact if exploited. The EPSS score of <1% suggests a low probability of real‑world exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires prior authentication—contributor or higher—and the use of the duplicate-post REST endpoint. No known remote code execution or privilege elevation beyond the capabilities to alter protected post meta can be achieved directly from the public internet. However, once protected meta keys like _wp_page_template are modified, there is potential for further indirect exploitation if additional content or plugins rely on these values. Consequently, administrators should treat the issue as a moderate risk that could enable unauthorized metadata manipulation.